Sutty/trabajo-afectivo
5
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Compare commits

base: Sutty:6c1a6b48a441d72e499d171aabb4dd904de81a16
Branches Tags
Sutty:antifascista
Sutty:antifascista-stable
Sutty:antifascista-stable-5.0
..
compare: Sutty:ea2cf81ab41654f06c8f4082c8766b764e0688cc
Branches Tags
Sutty:antifascista-stable
Sutty:antifascista-stable-5.0
Sutty:antifascista

No commits in common. "6c1a6b48a441d72e499d171aabb4dd904de81a16" and "ea2cf81ab41654f06c8f4082c8766b764e0688cc" have entirely different histories.
6c1a6b48a4 ... ea2cf81ab4

169 changed files with 2579 additions and 3600 deletions
Show stats Expand all files Collapse all files

40
.gitlab/merge_request_templates/Default.md
View file

@ -1,9 +1,8 @@
## What does this MR do?
<!--Insert the link to a GitHub issue in (), or describe the changes if there is no issue -->
[Issue Link]()
<!-- Is there a lot to say? Consider creating an issue. -->
## Screenshots <!-- Optional, very helpful for the reviewer colleagues from other teams -->
## Screenshots <!-- Optional -->
### Before
@ -13,7 +12,7 @@
![alt text](https://example.com/after.png)
## Code Changes
## Notes
* This MR
**does** <!-- KEEP ONLY ONE -->
@ -59,36 +58,9 @@ How do your performance changes scale on a system of this size?
they are really big customers, and we want to keep their business!)
-->
### Documentation Follow-up Required?
<!-- Keep one of the two sections -->
### Follow-up Required <!-- Optional -->
<!--
If this MR does change:
- How the user experiences or uses the application
- Visual appearance
- Screen flow
- Texts
- How the application is deployed an maintained
- Deployment process
- System requirements
- Command line interfaces
-->
This MR may require follow-up by the documentation team.
/label ~Documentation
<!--
Otherwise
Does your MR require coordination with the documentation/support teams?
If so, apply the label and explain here.
-->
This MR does not require any follow-up.
## QA Checklist (to be filled by the reviewer)
- [ ] Implementation satisfies specification
- [ ] Changes confirmed by manual testing
- [ ] [Code style](https://git.znuny.com/zammad/zammad/-/wikis/Coding-style-guide) is appropriate
- [ ] Performance will not degrade
- [ ] Code is properly covered with tests
- If follow-up by the documentation team is needed:
- [ ] Add a comment with this text
> @<!-- don't treat this as a mention until copied -->MrGeneration please check if this MR requires changes to the documentation. Thanks!

2
.pkgr.yml
View file

@ -116,6 +116,6 @@ env:
- ZAMMAD_RAILS_PORT=3000
- ZAMMAD_WEBSOCKET_PORT=6042
services:
- postgres:13
- postgres
before_install: contrib/packager.io/preinstall.sh
after_install: contrib/packager.io/postinstall.sh

2
.rubocop/default.yml
View file

@ -6,8 +6,6 @@ require:
- rubocop-performance
- rubocop-rails
- rubocop-rspec
- rubocop-inflector
- ../config/initializers/inflections.rb
- ./rubocop_zammad.rb
inherit_from:

4
.rubocop/todo.yml
View file

@ -887,6 +887,10 @@ Metrics/PerceivedComplexity:
- 'test/browser_test_helper.rb'
- 'test/integration/slack_test.rb'
Rails/AssertNot:
Exclude:
- 'test/browser/admin_permissions_granular_vs_full_test.rb'
Rails/CreateTableWithTimestamps:
Exclude:
- 'db/migrate/20120101000001_create_base.rb'

4
CHANGELOG.md
View file

@ -1,7 +1,7 @@
# Change Log
## [5.1.0](https://github.com/zammad/zammad/tree/5.1.0) (2021-xx-xx)
[Full Changelog](https://github.com/zammad/zammad/compare/5.0.0...5.1.0)
## [5.0.0](https://github.com/zammad/zammad/tree/5.0.0) (2021-xx-xx)
[Full Changelog](https://github.com/zammad/zammad/compare/4.1.0...5.0.0)
**Implemented enhancements:**

1
Gemfile
View file

@ -198,7 +198,6 @@ group :development, :test do
gem 'overcommit'
gem 'rubocop'
gem 'rubocop-faker'
gem 'rubocop-inflector'
gem 'rubocop-performance'
gem 'rubocop-rails'
gem 'rubocop-rspec'

27
Gemfile.lock
View file

@ -90,7 +90,7 @@ GEM
activerecord (>= 4.2)
addressable (2.8.0)
public_suffix (>= 2.0.2, < 5.0)
argon2 (2.1.1)
argon2 (2.0.3)
ffi (~> 1.14)
ffi-compiler (~> 1.0)
argon2 (2.0.3-x86_64-linux-musl)
@ -113,7 +113,7 @@ GEM
faraday
async-io (1.32.2)
async
async-pool (0.3.9)
async-pool (0.3.8)
async (>= 1.25)
autoprefixer-rails (10.3.3.0)
execjs (~> 2)
@ -188,7 +188,7 @@ GEM
docile (1.4.0)
domain_name (0.5.20190701)
unf (>= 0.0.5, < 1.0.0)
doorkeeper (5.5.4)
doorkeeper (5.5.3)
railties (>= 5)
dotenv (2.7.6)
eco (1.0.0)
@ -302,8 +302,9 @@ GEM
inflection (1.0.0)
iniparse (1.5.0)
interception (0.5)
json (2.5.1)
json (2.5.1-x86_64-linux-musl)
jwt (2.3.0)
jwt (2.2.3)
kgio (2.11.4)
kgio (2.11.4-x86_64-linux-musl)
koala (3.0.0)
@ -443,7 +444,7 @@ GEM
binding_of_caller (~> 1.0)
pry (~> 0.13)
public_suffix (4.0.6)
puma (4.3.10)
puma (4.3.8)
nio4r (~> 2.0)
puma (4.3.8-x86_64-linux-musl)
nio4r (~> 2.0)
@ -521,14 +522,15 @@ GEM
rspec-mocks (~> 3.10)
rspec-support (~> 3.10)
rspec-support (3.10.2)
rszr (0.5.2)
rszr (0.5.2-x86_64-linux-musl)
rubocop (1.22.1)
rubocop (1.21.0)
parallel (~> 1.10)
parser (>= 3.0.0.0)
rainbow (>= 2.2.2, < 4.0)
regexp_parser (>= 1.8, < 3.0)
rexml
rubocop-ast (>= 1.12.0, < 2.0)
rubocop-ast (>= 1.9.1, < 2.0)
ruby-progressbar (~> 1.7)
unicode-display_width (>= 1.4.0, < 3.0)
rubocop-ast (1.12.0)
@ -536,14 +538,10 @@ GEM
rubocop-faker (1.1.0)
faker (>= 2.12.0)
rubocop (>= 0.82.0)
rubocop-inflector (0.1.1)
activesupport
rubocop
rubocop-rspec
rubocop-performance (1.11.5)
rubocop (>= 1.7.0, < 2.0)
rubocop-ast (>= 0.4.0)
rubocop-rails (2.12.3)
rubocop-rails (2.12.2)
activesupport (>= 4.2.0)
rack (>= 1.1)
rubocop (>= 1.7.0, < 2.0)
@ -619,7 +617,7 @@ GEM
timers (4.3.3)
tins (1.29.1)
sync
twilio-ruby (5.59.0)
twilio-ruby (5.58.3)
faraday (>= 0.9, < 2.0)
jwt (>= 1.5, <= 2.5)
nokogiri (>= 1.6, < 2.0)
@ -766,7 +764,6 @@ DEPENDENCIES
rszr (= 0.5.2)
rubocop
rubocop-faker
rubocop-inflector
rubocop-performance
rubocop-rails
rubocop-rspec
@ -800,4 +797,4 @@ RUBY VERSION
ruby 2.7.3p183
BUNDLED WITH
2.2.27
2.2.20

2
VERSION
View file

@ -1 +1 @@
5.1.x
5.0.x

23
app/assets/javascripts/app/controllers/_application_controller/table.coffee
View file

@ -493,25 +493,6 @@ class App.ControllerTable extends App.Controller
sortable: @dndCallback
))
getGroupByKeyName: (object, groupBy) ->
reference_key = groupBy + '_id'
if reference_key of object
attribute = _.findWhere(object.constructor.configure_attributes, { name: reference_key })
return App[attribute.relation]?.find(object[reference_key])?.displayName() || reference_key
groupBy
sortObjectKeys: (objects, direction) ->
sorted = Object.keys(objects).sort()
switch direction
when 'DESC'
sorted.reverse()
else
sorted
renderTableRows: (sort = false) =>
if sort is true
@sortList()
@ -525,11 +506,11 @@ class App.ControllerTable extends App.Controller
objectsToShow = @objectsOfPage(@pagerShownPage)
if @groupBy
# group by raw (and not printable) value so dates work also
objectsGrouped = _.groupBy(objectsToShow, (object) => object[@getGroupByKeyName(object, @groupBy)])
objectsGrouped = _.groupBy(objectsToShow, (object) => object[@groupBy])
else
objectsGrouped = { '': objectsToShow }
for groupValue in @sortObjectKeys(objectsGrouped, @groupDirection)
for groupValue in Object.keys(objectsGrouped).sort()
groupObjects = objectsGrouped[groupValue]
for object in groupObjects

6
app/assets/javascripts/app/controllers/_ui_element/_application_ui_element.coffee
View file

@ -46,7 +46,7 @@ class App.UiElement.ApplicationUiElement
result = []
for row in selection
if attribute.translate
row.name = App.i18n.translatePlain(row.name)
row.name = App.i18n.translateInline(row.name)
if !_.isEmpty(row.children)
row.children = @getConfigOptionListArray(attribute, row.children)
result.push row
@ -65,7 +65,7 @@ class App.UiElement.ApplicationUiElement
for key in order
name_new = selection[key]
if attribute.translate
name_new = App.i18n.translatePlain(name_new)
name_new = App.i18n.translateInline(name_new)
attribute.options.push {
name: name_new
value: key
@ -162,7 +162,7 @@ class App.UiElement.ApplicationUiElement
nameNew = item.name
if attribute.translate
nameNew = App.i18n.translatePlain(nameNew)
nameNew = App.i18n.translateInline(nameNew)
row =
value: item.id,

2
app/assets/javascripts/app/controllers/_ui_element/core_workflow_condition.coffee
View file

@ -23,7 +23,7 @@ class App.UiElement.core_workflow_condition extends App.UiElement.ApplicationSel
organization:
name: 'Organization'
model: 'Organization'
model_show: ['User', 'Organization']
model_show: ['Organization']
'customer.organization':
name: 'Organization'
model: 'Organization'

1
app/assets/javascripts/app/controllers/_ui_element/core_workflow_perform.coffee
View file

@ -128,7 +128,6 @@ class App.UiElement.core_workflow_perform extends App.UiElement.ApplicationSelec
@buildValueConfigMultiple: (config, meta) ->
if _.contains(['add_option', 'remove_option', 'set_fixed_to'], meta.operator)
config.multiple = true
config.nulloption = true
else
config.multiple = false
config.nulloption = false

84
app/assets/javascripts/app/controllers/_ui_element/richtext.coffee
View file

@ -6,7 +6,7 @@ class App.UiElement.richtext
attribute.value = attribute.value.text
item = $( App.view('generic/richtext')(attribute: attribute, toolButtons: @toolButtons) )
item.find('[contenteditable]').ce(
@contenteditable = item.find('[contenteditable]').ce(
mode: attribute.type
maxlength: attribute.maxlength
buttons: attribute.buttons
@ -21,12 +21,12 @@ class App.UiElement.richtext
new App[plugin.controller](params)
if attribute.upload
attachments = []
@attachments = []
item.append( $( App.view('generic/attachment')(attribute: attribute) ) )
renderFile = (file) ->
renderFile = (file) =>
item.find('.attachments').append(App.view('generic/attachment_item')(file))
attachments.push file
@attachments.push file
if params && params.attachments
for file in params.attachments
@ -46,10 +46,10 @@ class App.UiElement.richtext
, form.form_id)
# remove items
item.find('.attachments').on('click', '.js-delete', (e) ->
item.find('.attachments').on('click', '.js-delete', (e) =>
id = $(e.currentTarget).data('id')
attachments = _.filter(
attachments,
@attachments = _.filter(
@attachments,
(item) ->
return if item.id.toString() is id.toString()
item
@ -71,35 +71,67 @@ class App.UiElement.richtext
element.empty()
)
App.Delay.set( ->
uploader = new App.Html5Upload(
@progressBar = item.find('.attachmentUpload-progressBar')
@progressText = item.find('.js-percentage')
@attachmentPlaceholder = item.find('.attachmentPlaceholder')
@attachmentUpload = item.find('.attachmentUpload')
@attachmentsHolder = item.find('.attachments')
@cancelContainer = item.find('.js-cancel')
u = => html5Upload.initialize(
uploadUrl: "#{App.Config.get('api_path')}/attachments"
dropContainer: item.closest('form')
cancelContainer: item.find('.js-cancel')
inputField: item.find('input')
dropContainer: item.closest('form').get(0)
cancelContainer: @cancelContainer
inputField: item.find('input').get(0)
maxSimultaneousUploads: 1,
key: 'File'
data:
form_id: item.closest('form').find('[name=form_id]').val()
onFileAdded: (file) =>
onFileStartCallback: ->
file.on(
onStart: =>
@attachmentPlaceholder.addClass('hide')
@attachmentUpload.removeClass('hide')
@cancelContainer.removeClass('hide')
item.find('[contenteditable]').trigger('fileUploadStart')
App.Log.debug 'UiElement.richtext', 'upload start'
onFileCompletedCallback: (response) ->
renderFile(response.data)
item.find('input').val('')
item.find('[contenteditable]').trigger('fileUploadStop', ['completed'])
onFileAbortedCallback: ->
onAborted: =>
@attachmentPlaceholder.removeClass('hide')
@attachmentUpload.addClass('hide')
item.find('input').val('')
item.find('[contenteditable]').trigger('fileUploadStop', ['aborted'])
attachmentPlaceholder: item.find('.attachmentPlaceholder')
attachmentUpload: item.find('.attachmentUpload')
progressBar: item.find('.attachmentUpload-progressBar')
progressText: item.find('.js-percentage')
)
# Called after received response from the server
onCompleted: (response) =>
response = JSON.parse(response)
uploader.render()
, 100, undefined, 'form_upload')
@attachmentPlaceholder.removeClass('hide')
@attachmentUpload.addClass('hide')
# reset progress bar
@progressBar.width(parseInt(0) + '%')
@progressText.text('')
renderFile(response.data)
item.find('input').val('')
item.find('[contenteditable]').trigger('fileUploadStop', ['completed'])
App.Log.debug 'UiElement.richtext', 'upload complete', response.data
# Called during upload progress, first parameter
# is decimal value from 0 to 100.
onProgress: (progress, fileSize, uploadedBytes) =>
@progressBar.width(parseInt(progress) + '%')
@progressText.text(parseInt(progress))
# hide cancel on 90%
if parseInt(progress) >= 90
@cancelContainer.addClass('hide')
App.Log.debug 'UiElement.richtext', 'uploadProgress ', parseInt(progress)
)
)
App.Delay.set(u, 100, undefined, 'form_upload')
item

10
app/assets/javascripts/app/controllers/agent_ticket_create.coffee
View file

@ -8,7 +8,7 @@ class App.TicketCreate extends App.Controller
events:
'click .type-tabs .tab': 'changeFormType'
'submit form': 'submit'
'click .form-controls .js-cancel': 'cancel'
'click .js-cancel': 'cancel'
'click .js-active-toggle': 'toggleButton'
types: {
@ -184,11 +184,8 @@ class App.TicketCreate extends App.Controller
@controllerUnbind('ticket_create_rerender', (template) => @renderQueue(template))
changed: =>
return true if @hasAttachments()
formCurrent = @formParam( @$('.ticket-create') )
diff = difference(@formDefault, formCurrent)
return false if !diff || _.isEmpty(diff)
return true
@ -464,9 +461,6 @@ class App.TicketCreate extends App.Controller
params: =>
params = @formParam(@$('.main form'))
hasAttachments: =>
@$('.richtext .attachments .attachment').length > 0
submit: (e) =>
e.preventDefault()
@ -569,7 +563,7 @@ class App.TicketCreate extends App.Controller
# save ticket, create article
# check attachment
if article['body']
if !@hasAttachments()
if @$('.richtext .attachments .attachment').length < 1
matchingWord = App.Utils.checkAttachmentReference(article['body'])
if matchingWord
if !confirm(App.i18n.translateContent('You use %s in text but no attachment is attached. Do you want to continue?', matchingWord))

4
app/assets/javascripts/app/controllers/core_workflow.coffee
View file

@ -1,6 +1,6 @@
class CoreWorkflow extends App.ControllerSubContent
requiredPermission: 'admin.core_workflow'
header: 'Core Workflows'
header: 'Core Workflow'
constructor: ->
super
@ -54,4 +54,4 @@ class CoreWorkflow extends App.ControllerSubContent
}
return mapping[screen] || screen
App.Config.set('CoreWorkflowObject', { prio: 1750, parent: '#system', name: 'Core Workflows', target: '#system/core_workflow', controller: CoreWorkflow, permission: ['admin.core_workflow'] }, 'NavBarAdmin')
App.Config.set('CoreWorkflowObject', { prio: 1750, parent: '#system', name: 'Core Workflow', target: '#system/core_workflow', controller: CoreWorkflow, permission: ['admin.core_workflow'] }, 'NavBarAdmin')

6
app/assets/javascripts/app/controllers/knowledge_base/public_menu_manager.coffee
View file

@ -27,13 +27,11 @@ class App.KnowledgeBasePublicMenuManager extends App.Controller
{
headline: 'Header menu',
identifier: 'header',
color: kb.color_header,
color_link: kb.color_header_link
color: kb.color_header
},
{
headline: 'Footer menu',
identifier: 'footer',
color_link: 'hsl(207,12%,50%)'
identifier: 'footer'
}
]

2
app/assets/javascripts/app/controllers/ticket_overview.coffee
View file

@ -1314,7 +1314,7 @@ class Table extends App.Controller
return if ticketListShow[0] || @permissionCheck('ticket.agent')
tickets_count = user.lifetimeCustomerTicketsCount()
@html App.view('customer_not_ticket_exists')(has_any_tickets: tickets_count > 0, is_allowed_to_create_ticket: @Config.get('customer_ticket_create'))
@html App.view('customer_not_ticket_exists')(has_any_tickets: tickets_count > 0)
if tickets_count == 0
@listenTo user, 'refresh', =>

5
app/assets/javascripts/app/controllers/ticket_zoom.coffee
View file

@ -200,10 +200,10 @@ class App.TicketZoom extends App.Controller
formMeta = data.form_meta
# on the following states we want to rerender the ticket:
# - if the object attribute configuration has changed (attribute values, dependecies, filters)
# - if the object attribute configuration has changed (attribute values, restrictions, filters)
# - if the user view has changed (agent/customer)
# - if the ticket permission has changed (read/write/full)
if @view && ( !_.isEqual(@formMeta.configure_attributes, formMeta.configure_attributes) || !_.isEqual(@formMeta.dependencies, formMeta.dependencies) || !_.isEqual(@formMeta.filter, formMeta.filter) || @view isnt view || @readable isnt readable || @changeable isnt changeable || @fullable isnt fullable )
if @view && ( !_.isEqual(@formMeta, formMeta) || @view isnt view || @readable isnt readable || @changeable isnt changeable || @fullable isnt fullable )
@renderDone = false
@view = view
@ -214,7 +214,6 @@ class App.TicketZoom extends App.Controller
# render page
@render(local)
App.Event.trigger('ui::ticket::load', data)
meta: =>

84
app/assets/javascripts/app/controllers/ticket_zoom/article_new.coffee
View file

@ -98,7 +98,7 @@ class App.TicketZoomArticleNew extends App.Controller
@controllerBind('ui:rerender', =>
@adjustedTextarea = false
@defaults = @ui.taskGet('article')
@attachments = @defaults.attachments || []
@attachments = @defaults.attachments
@render()
)
@ -117,7 +117,7 @@ class App.TicketZoomArticleNew extends App.Controller
@tokanice(@type)
if @defaults.body or @attachments.length > 0 or @isIE10()
if @defaults.body or @isIE10()
@openTextarea(null, true)
tokanice: (type = 'email') ->
@ -191,30 +191,82 @@ class App.TicketZoomArticleNew extends App.Controller
maxlength: 150000
})
new App.Html5Upload(
html5Upload.initialize(
uploadUrl: "#{App.Config.get('api_path')}/upload_caches/#{@form_id}"
dropContainer: @$('.article-add')
dropContainer: @$('.article-add').get(0)
cancelContainer: @cancelContainer
inputField: @$('.article-attachment input')
inputField: @$('.article-attachment input').get(0)
key: 'File'
maxSimultaneousUploads: 1
onFileAdded: (file) =>
onFileStartCallback: =>
@callbackFileUploadStart?()
file.on(
onFileCompletedCallback: (response) =>
onStart: =>
@attachmentPlaceholder.addClass('hide')
@attachmentUpload.removeClass('hide')
@cancelContainer.removeClass('hide')
if @callbackFileUploadStart
@callbackFileUploadStart()
onAborted: =>
@attachmentPlaceholder.removeClass('hide')
@attachmentUpload.addClass('hide')
@$('.article-attachment input').val('')
if @callbackFileUploadStop
@callbackFileUploadStop()
# Called after received response from the server
onCompleted: (response) =>
response = JSON.parse(response)
@attachments.push response.data
@attachmentPlaceholder.removeClass('hide')
@attachmentUpload.addClass('hide')
# reset progress bar
@progressBar.width(parseInt(0) + '%')
@progressText.text('')
@renderAttachment(response.data)
@$('.article-attachment input').val('')
@callbackFileUploadStop?()
if @callbackFileUploadStop
@callbackFileUploadStop()
onFileAbortedCallback: =>
@callbackFileUploadStop?()
# Called during upload progress, first parameter
# is decimal value from 0 to 100.
onProgress: (progress, fileSize, uploadedBytes) =>
@progressBar.width(parseInt(progress) + '%')
@progressText.text(parseInt(progress))
# hide cancel on 90%
if parseInt(progress) >= 90
@cancelContainer.addClass('hide')
attachmentPlaceholder: @attachmentPlaceholder
attachmentUpload: @attachmentUpload
progressBar: @progressBar
progressText: @progressText
).render()
# Called when upload failed
onError: (message) =>
@attachmentPlaceholder.removeClass('hide')
@attachmentUpload.addClass('hide')
@$('.article-attachment input').val('')
if @callbackFileUploadStop
@callbackFileUploadStop()
new App.ControllerModal(
head: 'Upload Failed'
buttonCancel: 'Cancel'
buttonCancelClass: 'btn--danger'
buttonSubmit: false
message: message
shown: true
small: true
container: @el.closest('.content')
)
)
)
@bindAttachmentDelete()

4
app/assets/javascripts/app/controllers/ticket_zoom/form_handler_core_workflow.coffee
View file

@ -119,9 +119,7 @@ class App.FormHandlerCoreWorkflow
valueFound = false
for value in values
# false values are valid values e.g. for boolean fields (be careful)
if value isnt undefined && paramValue isnt undefined
if value && paramValue
if value.toString() == paramValue.toString()
valueFound = true
break

39
app/assets/javascripts/app/controllers/ticket_zoom/sidebar_ticket.coffee
View file

@ -1,21 +1,12 @@
# No usage of a ControllerObserver here because we want to use
# the data of the ticket zoom ajax request which is using the all=true parameter
# and contain the core workflow information as well. Without observer we also
# dont have double rendering because of the zoom (all=true) and observer (full=true) render callback
class Edit extends App.Controller
constructor: (params) ->
super
@controllerBind('ui::ticket::load', (data) =>
return if data.ticket_id.toString() isnt @ticket.id.toString()
class Edit extends App.ControllerObserver
model: 'Ticket'
observeNot:
created_at: true
updated_at: true
globalRerender: false
@ticket = App.Ticket.find(@ticket.id)
@formMeta = data.form_meta
@render()
)
@render()
render: =>
defaults = @ticket.attributes()
render: (ticket, diff) =>
defaults = ticket.attributes()
delete defaults.article # ignore article infos
followUpPossible = App.Group.find(defaults.group_id).follow_up_possible
ticketState = App.TicketState.find(defaults.state_id).name
@ -25,13 +16,10 @@ class Edit extends App.Controller
if !_.isEmpty(taskState)
defaults = _.extend(defaults, taskState)
# remove core workflow data because it should trigger a request to get data
# for the new ticket + eventually changed task state
@formMeta.core_workflow = undefined
if followUpPossible == 'new_ticket' && ticketState != 'closed' ||
followUpPossible != 'new_ticket' ||
@permissionCheck('admin') || @ticket.currentView() is 'agent'
@permissionCheck('admin') || ticket.currentView() is 'agent'
@controllerFormSidebarTicket = new App.ControllerForm(
elReplace: @el
model: { className: 'Ticket', configure_attributes: @formMeta.configure_attributes || App.Ticket.configure_attributes }
@ -40,7 +28,7 @@ class Edit extends App.Controller
filter: @formMeta.filter
formMeta: @formMeta
params: defaults
isDisabled: !@ticket.editable()
isDisabled: !ticket.editable()
taskKey: @taskKey
core_workflow: {
callbacks: [@markForm]
@ -56,7 +44,7 @@ class Edit extends App.Controller
filter: @formMeta.filter
formMeta: @formMeta
params: defaults
isDisabled: @ticket.editable()
isDisabled: ticket.editable()
taskKey: @taskKey
core_workflow: {
callbacks: [@markForm]
@ -69,8 +57,8 @@ class Edit extends App.Controller
return if @resetBind
@resetBind = true
@controllerBind('ui::ticket::taskReset', (data) =>
return if data.ticket_id.toString() isnt @ticket.id.toString()
@render()
return if data.ticket_id.toString() isnt ticket.id.toString()
@render(ticket)
)
class SidebarTicket extends App.Controller
@ -140,7 +128,6 @@ class SidebarTicket extends App.Controller
@edit = new Edit(
object_id: @ticket.id
ticket: @ticket
el: localEl.find('.edit')
taskGet: @taskGet
formMeta: @formMeta

98
app/assets/javascripts/app/lib/app_post/html5_upload.coffee
View file

@ -1,98 +0,0 @@
class App.Html5Upload extends App.Controller
uploadUrl: null
maxSimultaneousUploads: 1
key: 'File'
data: null
onFileStartCallback: null
onFileCompletedCallback: null
onFileAbortedCallback: null
dropContainer: null
cancelContainer: null
inputField: null
attachmentPlaceholder: null
attachmentUpload: null
progressBar: null
progressText: null
render: =>
html5Upload.initialize(
uploadUrl: @uploadUrl
dropContainer: @dropContainer.get(0)
cancelContainer: @cancelContainer
inputField: @inputField.get(0)
maxSimultaneousUploads: @maxSimultaneousUploads
key: @key
data: @data
onFileAdded: @onFileAdded
)
onFileAdded: (file) =>
file.on(
onStart: @onFileStart
onAborted: @onFileAborted
onCompleted: @onFileCompleted
onProgress: @onFileProgress
onError: @onFileError
)
onFileStart: =>
@attachmentPlaceholder.addClass('hide')
@attachmentUpload.removeClass('hide')
@cancelContainer.removeClass('hide')
App.Log.debug 'Html5Upload', 'upload start'
@onFileStartCallback?()
onFileProgress: (progress, fileSize, uploadedBytes) =>
progress = parseInt(progress)
@progressBar.width(progress + '%')
@progressText.text(progress)
# hide cancel on 90%
if progress >= 90
@cancelContainer.addClass('hide')
App.Log.debug 'Html5Upload', 'uploadProgress ', progress
onFileCompleted: (response) =>
response = JSON.parse(response)
@hideFileUploading()
@onFileCompletedCallback?(response)
App.Log.debug 'Html5Upload', 'upload complete', response.data
onFileAborted: =>
@hideFileUploading()
@onFileAbortedCallback?()
App.Log.debug 'Html5Upload', 'upload aborted'
onFileError: (message) =>
@hideFileUploading()
@inputField.val('')
@callbackFileUploadStop?()
new App.ControllerModal(
head: 'Upload Failed'
buttonCancel: 'Cancel'
buttonCancelClass: 'btn--danger'
buttonSubmit: false
message: message || 'Cannot upload file'
shown: true
small: true
container: @inputField.closest('.content')
)
App.Log.debug 'Html5Upload', 'upload error'
hideFileUploading: =>
@attachmentPlaceholder.removeClass('hide')
@attachmentUpload.addClass('hide')
@progressBar.width('0%')
@progressText.text('0')

3
app/assets/javascripts/app/lib/base/html5Upload.js
View file

@ -255,7 +255,7 @@
manager.ajaxUpload(manager.uploadsQueue.shift());
}
};
xhr.onabort = function (event) {
xhr.abort = function (event) {
console.log('Upload abort');
// Reduce number of active uploads:
@ -269,7 +269,6 @@
// Triggered when upload fails:
xhr.onerror = function () {
console.log('Upload failed: ', upload.fileName);
upload.events.onError('Upload failed: ' + upload.fileName);
};
// Append additional data if provided:

13
app/assets/javascripts/app/models/knowledge_base.coffee
View file

@ -1,5 +1,5 @@
class App.KnowledgeBase extends App.Model
@configure 'KnowledgeBase', 'iconset', 'color_highlight', 'color_header', 'color_header_link', 'translation_ids', 'locale_ids', 'homepage_layout', 'category_layout', 'custom_address'
@configure 'KnowledgeBase', 'iconset', 'color_highlight', 'color_header', 'translation_ids', 'locale_ids', 'homepage_layout', 'category_layout', 'custom_address'
@extend Spine.Model.Ajax
@extend App.KnowledgeBaseActions
@url: @apiPath + '/knowledge_bases'
@ -148,17 +148,6 @@ class App.KnowledgeBase extends App.Model
display: false
horizontal: true
shown: true
}, {
name: 'color_header_link'
display: 'Header Link Color'
tag: 'color'
style: 'block'
null: false
screen:
admin_style_color_header_link:
display: false
horizontal: true
shown: true
# Layout picker is disabled in V1
#}, {
# name: 'homepage_layout'

5
app/assets/javascripts/app/models/user.coffee
View file

@ -344,12 +344,9 @@ class App.User extends App.Model
@sameOrganization?(requester)
isChangeableBy: (requester) ->
# full access for admins
return true if requester.permission('admin.user')
# forbid non-agents to change users
# allow agents to change customers
return false if !requester.permission('ticket.agent')
# allow agents to change customers only
return false if @permission(['admin.user', 'ticket.agent'])
@permission('ticket.customer')
isDeleteableBy: (requester) ->

4
app/assets/javascripts/app/views/customer_not_ticket_exists.jst.eco
View file

@ -6,15 +6,11 @@
<% if @has_any_tickets: %>
<p><%- @T('You have no tickets to display in this overview.') %></p>
<% else: %>
<% if @is_allowed_to_create_ticket: %>
<p><%- @T('You have not created a ticket yet.') %></p>
<p><%- @T('The way to communicate with us is this thing called "ticket".') %></p>
<p><%- @T('Please click the button below to create your first one.') %></p>
<p><a class="btn btn--primary" href="#customer_ticket_new"><%- @T('Create your first ticket') %></a></p>
<% else: %>
<p><%- @T('You currently don\'t have any tickets.') %></p>
<% end %>
<% end %>
</div>
</div>

2
app/assets/javascripts/app/views/data_privacy/preview.jst.eco
View file

@ -14,7 +14,7 @@
</div>
<div class="form-group js-sure">
<h3 class="danger-color"><%- @T('Warning') %></h3>
<p class="danger-color"><%- @T('There is no rollback of this deletion possible. If you are absolutely sure to do this, then type in "%s" into the input.', App.i18n.translatePlain('delete').toUpperCase()) %></p>
<p class="danger-color"><%- @T('There is no rollback of this deletion possible. If you are absolutely sure to do this, then type in "%s" into the input.', App.i18n.translateInline('delete').toUpperCase()) %></p>
<%- @sure_html %>
</div>
</div>

2
app/assets/javascripts/app/views/generic/attachment.jst.eco
View file

@ -17,7 +17,7 @@
<%- @T('Uploading') %> (<span class="js-percentage">0</span>%) ...
</div>
<div class="attachmentUpload-cancel js-cancel">
<%- @Icon('diagonal-cross') %><%- @T('Cancel Upload') %>
<%- @Icon('diagonal-cross') %></div><%- @T('Cancel Upload') %>
</div>
</div>
<div class="attachmentUpload-progressBar" style="width: 0%"></div>

1
app/assets/javascripts/app/views/knowledge_base/new_modal.coffee
View file

@ -29,7 +29,6 @@ class App.KnowledgeBaseNewModal extends App.ControllerModal
params['iconset'] = 'FontAwesome'
params['color_highlight'] = '#38ae6a'
params['color_header'] = '#f9fafb'
params['color_header_link'] = 'hsl(206,8%,50%)'
params['homepage_layout'] = 'grid'
params['category_layout'] = 'grid'

2
app/assets/javascripts/app/views/knowledge_base/public_menu_manager.jst.eco
View file

@ -14,7 +14,7 @@
<div class="kb-menu-preview">
<div class="label"><%= kb_locale.systemLocale().name %></div>
<div class="kb-menu-preview-container kb-menu-preview-container--<%= location.identifier %>" style="background-color: <%= location.color %>; color: <%= location.color_link %>;">
<div class="kb-menu-preview-container kb-menu-preview-container--<%= location.identifier %>" style="background-color: <%= location.color %>">
<% menu_items = App.KnowledgeBaseMenuItem.using_kb_locale_location(kb_locale, location.identifier) %>
<% if menu_items.length == 0: %>

2
app/assets/javascripts/app/views/login.jst.eco
View file

@ -1,7 +1,7 @@
<div class="login fullscreen">
<div class="fullscreen-center">
<div class="fullscreen-body">
<p><%- @T('Log in to %s', @C('fqdn')) %></p>
<p><%- @T('Login with %s', @C('fqdn')) %></p>
<% if @C('maintenance_mode'): %>
<div class="hero-unit alert alert--danger js-maintenanceMode"><%- @T('Zammad is currently in maintenance mode. Only administrators can login. Please wait until the maintenance window is over.') %></div>

5
app/assets/javascripts/app/views/package.jst.eco
View file

@ -3,11 +3,6 @@
</div>
<div class="page-content">
<p>
<%- @T('The installation of packages comes with security implications, because arbitrary code will be executed in the context of the Zammad application.') %>
<br>
<%- @T('Only packages from known, trusted and verfied sources should be installed.') %>
</p>
<p>
<%- @T('After installing, updating or uninstalling packages the following commands need to be executed on the server:') %>
<ul>

24
app/assets/stylesheets/zammad.scss
View file

@ -2661,7 +2661,7 @@ input.has-error {
}
a {
color: inherit;
color: hsl(206,8%,50%);
}
.label {
@ -7017,8 +7017,8 @@ footer {
.article-new .textBubble {
border-color: #b3b3b3;
border-radius: 5px;
padding-left: 12px;
padding-right: 12px;
padding-left: 0;
padding-right: 0;
cursor: text;
}
@ -7051,23 +7051,13 @@ footer {
padding: 10px 0;
color: #b3b3b3;
overflow: hidden;
@extend .u-textTruncate;
@extend .u-unclickable, .u-textTruncate;
}
.attachments:not(:empty) {
padding: 9px 5px;
border-top: 1px solid hsl(0,0%,93%);
margin: 6px -12px 30px;
}
.ticket-create .attachments:not(:empty) {
margin-left: 0;
margin-right: 0;
margin-bottom: 56px;
}
.ticket-create .attachment--row {
line-height: 1.45;
margin: 6px 0 30px;
}
.attachment.attachment--row {
@ -8452,10 +8442,6 @@ footer {
.dropdown li.with-category, .dropdown.dropdown--actions li.with-category {
line-height: 19.5px;
small {
color: #fff !important;
}
}
.dropdown.dropdown--actions li.with-category {

2
app/controllers/application_controller.rb
View file

@ -10,8 +10,8 @@ class ApplicationController < ActionController::Base
include ApplicationController::RendersModels
include ApplicationController::HasUser
include ApplicationController::HasResponseExtentions
include ApplicationController::HasDownload
include ApplicationController::PreventsCsrf
include ApplicationController::HasSecureContentSecurityPolicyForDownloads
include ApplicationController::LogsHttpAccess
include ApplicationController::Authorizes
end

44
app/controllers/application_controller/has_download.rb
View file

@ -1,44 +0,0 @@
# Copyright (C) 2012-2021 Zammad Foundation, http://zammad-foundation.org/
module ApplicationController::HasDownload
extend ActiveSupport::Concern
included do
around_action do |_controller, block|
subscriber = proc do
policy = ActionDispatch::ContentSecurityPolicy.new
policy.default_src :none
# The 'plugin_types' rule is deprecated and should be changed in the future.
policy.plugin_types 'application/pdf'
request.content_security_policy = policy
end
ActiveSupport::Notifications.subscribed(subscriber, 'send_file.action_controller') do
ActiveSupport::Notifications.subscribed(subscriber, 'send_data.action_controller') do
block.call
end
end
end
end
private
def file_id
@file_id ||= params[:id]
end
def download_file
@download_file ||= ::ApplicationController::HasDownload::DownloadFile.new(file_id, disposition: sanitized_disposition)
end
def sanitized_disposition
disposition = params.fetch(:disposition, 'inline')
valid_disposition = %w[inline attachment]
return disposition if valid_disposition.include?(disposition)
raise Exceptions::Forbidden, "Invalid disposition #{disposition} requested. Only #{valid_disposition.join(', ')} are valid."
end
end

54
app/controllers/application_controller/has_download/download_file.rb
View file

@ -1,54 +0,0 @@
# Copyright (C) 2012-2021 Zammad Foundation, http://zammad-foundation.org/
class ApplicationController::HasDownload::DownloadFile < SimpleDelegator
attr_reader :requested_disposition
def initialize(id, disposition: 'inline')
@requested_disposition = disposition
super(Store.find(id))
end
def disposition
return 'attachment' if forcibly_download_as_binary? || !allowed_inline?
requested_disposition
end
def content_type
return ActiveStorage.binary_content_type if forcibly_download_as_binary?
file_content_type
end
def content(view_type)
return __getobj__.content if view_type.blank? || !preferences[:resizable]
return content_inline if content_inline? && view_type == 'inline'
return content_preview if content_preview? && view_type == 'preview'
__getobj__.content
end
private
def allowed_inline?
ActiveStorage.content_types_allowed_inline.include?(content_type)
end
def forcibly_download_as_binary?
ActiveStorage.content_types_to_serve_as_binary.include?(file_content_type)
end
def file_content_type
@file_content_type ||= preferences['Content-Type'] || preferences['Mime-Type'] || ActiveStorage.binary_content_type
end
def content_inline?
preferences[:content_inline] == true
end
def content_preview?
preferences[:content_preview] == true
end
end

25
app/controllers/application_controller/has_secure_content_security_policy_for_downloads.rb Normal file
View file

@ -0,0 +1,25 @@
# Copyright (C) 2012-2021 Zammad Foundation, http://zammad-foundation.org/
module ApplicationController::HasSecureContentSecurityPolicyForDownloads
extend ActiveSupport::Concern
included do
around_action do |_controller, block|
subscriber = proc do
policy = ActionDispatch::ContentSecurityPolicy.new
policy.default_src :none
policy.plugin_types 'application/pdf'
request.content_security_policy = policy
end
ActiveSupport::Notifications.subscribed(subscriber, 'send_file.action_controller') do
ActiveSupport::Notifications.subscribed(subscriber, 'send_data.action_controller') do
block.call
end
end
end
end
end

25
app/controllers/attachments_controller.rb
View file

@ -6,13 +6,14 @@ class AttachmentsController < ApplicationController
prepend_before_action :authentication_check_only, only: %i[show destroy]
def show
view_type = params[:preview] ? 'preview' : nil
content = @file.content_preview if params[:preview] && @file.preferences[:content_preview]
content ||= @file.content
send_data(
download_file.content(view_type),
filename: download_file.filename,
type: download_file.content_type,
disposition: download_file.disposition
content,
filename: @file.filename,
type: @file.preferences['Content-Type'] || @file.preferences['Mime-Type'] || 'application/octet-stream',
disposition: sanitized_disposition
)
end
@ -51,7 +52,7 @@ class AttachmentsController < ApplicationController
end
def destroy
Store.remove_item(download_file.id)
Store.remove_item(@file.id)
render json: {
success: true,
@ -71,8 +72,18 @@ class AttachmentsController < ApplicationController
private
def sanitized_disposition
disposition = params.fetch(:disposition, 'inline')
valid_disposition = %w[inline attachment]
return disposition if valid_disposition.include?(disposition)
raise Exceptions::Forbidden, "Invalid disposition #{disposition} requested. Only #{valid_disposition.join(', ')} are valid."
end
def authorize!
record = download_file&.store_object&.name&.safe_constantize&.find(download_file.o_id)
@file = Store.find(params[:id])
record = @file&.store_object&.name&.safe_constantize&.find(@file.o_id)
authorize(record) if record
rescue Pundit::NotAuthorizedError
raise ActiveRecord::RecordNotFound

4
app/controllers/form_controller.rb
View file

@ -156,7 +156,7 @@ class FormController < ApplicationController
end
def token_gen(fingerprint)
crypt = ActiveSupport::MessageEncryptor.new(Setting.get('application_secret')[0, 32], serializer: JSON)
crypt = ActiveSupport::MessageEncryptor.new(Setting.get('application_secret')[0, 32])
fingerprint = "#{Base64.strict_encode64(Setting.get('fqdn'))}:#{Time.zone.now.to_i}:#{Base64.strict_encode64(fingerprint)}"
Base64.strict_encode64(crypt.encrypt_and_sign(fingerprint))
end
@ -167,7 +167,7 @@ class FormController < ApplicationController
raise Exceptions::Forbidden
end
begin
crypt = ActiveSupport::MessageEncryptor.new(Setting.get('application_secret')[0, 32], serializer: JSON)
crypt = ActiveSupport::MessageEncryptor.new(Setting.get('application_secret')[0, 32])
result = crypt.decrypt_and_verify(Base64.decode64(token))
rescue
Rails.logger.info 'Invalid token for form!'

36
app/controllers/ticket_articles_controller.rb
View file

@ -175,11 +175,29 @@ class TicketArticlesController < ApplicationController
end
raise Exceptions::Forbidden, 'Requested file id is not linked with article_id.' if !access
# find file
file = Store.find(params[:id])
disposition = sanitized_disposition
content = nil
if params[:view].present? && file.preferences[:resizable] == true
if file.preferences[:content_inline] == true && params[:view] == 'inline'
content = file.content_inline
elsif file.preferences[:content_preview] == true && params[:view] == 'preview'
content = file.content_preview
end
end
if content.blank?
content = file.content
end
send_data(
download_file.content(params[:view]),
filename: download_file.filename,
type: download_file.content_type,
disposition: download_file.disposition
content,
filename: file.filename,
type: file.preferences['Content-Type'] || file.preferences['Mime-Type'] || 'application/octet-stream',
disposition: disposition
)
end
@ -260,4 +278,14 @@ class TicketArticlesController < ApplicationController
render json: result
end
private
def sanitized_disposition
disposition = params.fetch(:disposition, 'inline')
valid_disposition = %w[inline attachment]
return disposition if valid_disposition.include?(disposition)
raise Exceptions::Forbidden, "Invalid disposition #{disposition} requested. Only #{valid_disposition.join(', ')} are valid."
end
end

33
app/controllers/users_controller.rb
View file

@ -722,28 +722,31 @@ curl http://localhost/api/v1/users/image/8d6cca1c6bdc226cf2ba131e264ca2c7 -v -u
=end
def image
# cache image
response.headers['Expires'] = 1.year.from_now.httpdate
response.headers['Cache-Control'] = 'cache, store, max-age=31536000, must-revalidate'
response.headers['Pragma'] = 'cache'
file = Avatar.get_by_hash(params[:hash])
if file
file_content_type = file.preferences['Content-Type'] || file.preferences['Mime-Type']
return serve_default_image if ActiveStorage.content_types_allowed_inline.exclude?(file_content_type)
send_data(
file.content,
filename: file.filename,
type: file_content_type,
type: file.preferences['Content-Type'] || file.preferences['Mime-Type'],
disposition: 'inline'
)
return
end
serve_default_image
# serve default image
image = 'R0lGODdhMAAwAOMAAMzMzJaWlr6+vqqqqqOjo8XFxbe3t7GxsZycnAAAAAAAAAAAAAAAAAAAAAAAAAAAACwAAAAAMAAwAAAEcxDISau9OOvNu/9gKI5kaZ5oqq5s675wLM90bd94ru98TwuAA+KQAQqJK8EAgBAgMEqmkzUgBIeSwWGZtR5XhSqAULACCoGCJGwlm1MGQrq9RqgB8fm4ZTUgDBIEcRR9fz6HiImKi4yNjo+QkZKTlJWWkBEAOw=='
send_data(
Base64.decode64(image),
filename: 'image.gif',
type: 'image/gif',
disposition: 'inline'
)
end
=begin
@ -775,11 +778,6 @@ curl http://localhost/api/v1/users/avatar -v -u #{login}:#{password} -H "Content
return
end
if ActiveStorage::Variant::WEB_IMAGE_CONTENT_TYPES.exclude?(file_full[:mime_type])
render json: { error: 'Mime type is invalid' }, status: :unprocessable_entity
return
end
begin
file_resize = StaticAssets.data_url_attributes(params[:avatar_resize])
rescue
@ -1063,15 +1061,4 @@ curl http://localhost/api/v1/users/avatar -v -u #{login}:#{password} -H "Content
render json: { message: 'ok' }, status: :created
end
def serve_default_image
image = 'R0lGODdhMAAwAOMAAMzMzJaWlr6+vqqqqqOjo8XFxbe3t7GxsZycnAAAAAAAAAAAAAAAAAAAAAAAAAAAACwAAAAAMAAwAAAEcxDISau9OOvNu/9gKI5kaZ5oqq5s675wLM90bd94ru98TwuAA+KQAQqJK8EAgBAgMEqmkzUgBIeSwWGZtR5XhSqAULACCoGCJGwlm1MGQrq9RqgB8fm4ZTUgDBIEcRR9fz6HiImKi4yNjo+QkZKTlJWWkBEAOw=='
send_data(
Base64.decode64(image),
filename: 'image.gif',
type: 'image/gif',
disposition: 'inline'
)
end
end

4
app/controllers/webhooks_controller.rb
View file

@ -4,7 +4,9 @@ class WebhooksController < ApplicationController
prepend_before_action { authentication_check && authorize! }
def preview
ticket = TicketPolicy::ReadScope.new(current_user).resolve.last
access_condition = Ticket.access_condition(current_user, 'read')
ticket = Ticket.where(access_condition).last
render json: JSON.pretty_generate({
ticket: TriggerWebhookJob::RecordPayload.generate(ticket),

3
app/jobs/upload_cache_cleanup_job.rb
View file

@ -3,7 +3,6 @@
class UploadCacheCleanupJob < ApplicationJob
def perform
taskbar_form_ids = Taskbar.with_form_id.filter_map(&:persisted_form_id)
return if store_object_id.blank?
Store.where(store_object_id: store_object_id).where('created_at < ?', 1.month.ago).where.not(o_id: taskbar_form_ids).find_each do |store|
Store.remove_item(store.id)
@ -13,6 +12,6 @@ class UploadCacheCleanupJob < ApplicationJob
private
def store_object_id
Store::Object.lookup(name: 'UploadCache')&.id
Store::Object.lookup(name: 'UploadCache').id
end
end

11
app/models/application_model/can_associations.rb
View file

@ -121,7 +121,7 @@ returns
key = "#{self.class}::aws::#{id}"
cache = Cache.read(key)
return filter_unauthorized_attributes(cache) if cache
return cache if cache
attributes = self.attributes
relevant = %i[has_and_belongs_to_many has_many]
@ -160,7 +160,7 @@ returns
filter_attributes(attributes)
Cache.write(key, attributes)
filter_unauthorized_attributes(attributes)
attributes
end
=begin
@ -234,7 +234,8 @@ returns
end
filter_attributes(attributes)
filter_unauthorized_attributes(attributes)
attributes
end
def filter_attributes(attributes)
@ -242,10 +243,6 @@ returns
attributes.except!('password', 'token', 'tokens', 'token_ids')
end
def filter_unauthorized_attributes(attributes)
attributes
end
=begin
reference if association id check

1
app/models/avatar.rb
View file

@ -72,6 +72,7 @@ add avatar by url
=end
def self.add(data)
# lookups
if data[:object]
object_id = ObjectLookup.by_name(data[:object])

7
app/models/channel/driver/imap.rb
View file

@ -7,8 +7,6 @@ class Channel::Driver::Imap < Channel::EmailParser
FETCH_METADATA_TIMEOUT = 2.minutes
FETCH_MSG_TIMEOUT = 4.minutes
EXPUNGE_TIMEOUT = 16.minutes
DEFAULT_TIMEOUT = 45.seconds
CHECK_ONLY_TIMEOUT = 6.seconds
def fetchable?(_channel)
true
@ -112,7 +110,10 @@ example
Rails.logger.info "fetching imap (#{options[:host]}/#{options[:user]} port=#{port},ssl=#{ssl},starttls=#{starttls},folder=#{folder},keep_on_server=#{keep_on_server},auth_type=#{options.fetch(:auth_type, 'LOGIN')})"
# on check, reduce open_timeout to have faster probing
check_type_timeout = check_type == 'check' ? CHECK_ONLY_TIMEOUT : DEFAULT_TIMEOUT
check_type_timeout = 45
if check_type == 'check'
check_type_timeout = 6
end
timeout(check_type_timeout) do
@imap = ::Net::IMAP.new(options[:host], port, ssl, nil, false)

2
app/models/channel/email_parser.rb
View file

@ -502,7 +502,7 @@ process unprocessable_mails (tmp/unprocessable_mail/*.eml) again
path = Rails.root.join('tmp/unprocessable_mail')
files = []
Dir.glob("#{path}/*.eml") do |entry|
ticket, _article, _user, _mail = Channel::EmailParser.new.process(params, File.binread(entry))
ticket, _article, _user, _mail = Channel::EmailParser.new.process(params, IO.binread(entry))
next if ticket.blank?
files.push entry

27
app/models/core_workflow/attributes.rb
View file

@ -30,26 +30,10 @@ class CoreWorkflow::Attributes
end
end
def selectable_field?(key)
return if key == 'id'
return if !@payload['params'].key?(key)
# some objects have no attributes like "CoreWorkflow"-object as well.
# attributes only exists in the frontend so we skip this check
return true if object_elements.blank?
object_elements_hash.key?(key)
end
def overwrite_selected(result)
selected_attributes = selected_only.attributes
selected_attributes.each_key do |key|
next if !selectable_field?(key)
# special behaviour for owner id
if key == 'owner_id' && selected_attributes[key].nil?
selected_attributes[key] = 1
end
next if selected_attributes[key].nil?
result[key.to_sym] = selected_attributes[key]
end
@ -71,10 +55,7 @@ class CoreWorkflow::Attributes
# dont use lookup here because the cache will not
# know about new attributes and make crashes
@saved_only ||= payload_class.find_by(id: @payload['params']['id'])
# we use marshal here because clone still uses references and dup can't
# detect changes for the rails object
Marshal.load(Marshal.dump(@saved_only))
@saved_only.dup
end
def saved
@ -87,10 +68,6 @@ class CoreWorkflow::Attributes
end
end
def object_elements_hash
@object_elements_hash ||= object_elements.index_by { |x| x[:name] }
end
def screen_value(attribute, type)
attribute[:screens].dig(@payload['screen'], type)
end

22
app/models/core_workflow/result/backend.rb
View file

@ -18,26 +18,4 @@ class CoreWorkflow::Result::Backend
def result(backend, field, value = nil)
@result_object.run_backend_value(backend, field, value)
end
def saved_value
# make sure we have a saved object
return if @result_object.attributes.saved_only.blank?
# we only want to have the saved value in the restrictions
# if no changes happend to the form. If the users does changes
# to the form then also the saved value should get removed
return if @result_object.attributes.selected.changed?
# attribute can be blank e.g. in custom development
# or if attribute is only available in the frontend but not
# in the backend
return if attribute.blank?
@result_object.attributes.saved_attribute_value(attribute).to_s
end
def attribute
@attribute ||= @result_object.attributes.object_elements_hash[field]
end
end

8
app/models/core_workflow/result/remove_option.rb
View file

@ -3,14 +3,8 @@
class CoreWorkflow::Result::RemoveOption < CoreWorkflow::Result::BaseOption
def run
@result_object.result[:restrict_values][field] ||= Array(@result_object.payload['params'][field])
@result_object.result[:restrict_values][field] -= Array(config_value)
@result_object.result[:restrict_values][field] -= Array(@perform_config['remove_option'])
remove_excluded_param_values
true
end
def config_value
result = Array(@perform_config['remove_option'])
result -= Array(saved_value)
result
end
end

14
app/models/core_workflow/result/set_fixed_to.rb
View file

@ -5,23 +5,21 @@ class CoreWorkflow::Result::SetFixedTo < CoreWorkflow::Result::BaseOption
@result_object.result[:restrict_values][field] = if restriction_set?
restrict_values
else
config_value
replace_values
end
remove_excluded_param_values
true
end
def config_value
result = Array(@perform_config['set_fixed_to'])
result |= Array(saved_value)
result
end
def restriction_set?
@result_object.result[:restrict_values][field]
end
def restrict_values
@result_object.result[:restrict_values][field].reject { |v| config_value.exclude?(v) }
@result_object.result[:restrict_values][field].reject { |v| Array(@perform_config['set_fixed_to']).exclude?(v) }
end
def replace_values
Array(@perform_config['set_fixed_to'])
end
end

2
app/models/group.rb
View file

@ -12,8 +12,6 @@ class Group < ApplicationModel
include HasTicketCreateScreenImpact
include HasSearchIndexBackend
include Group::Assets
belongs_to :email_address, optional: true
belongs_to :signature, optional: true

14
app/models/group/assets.rb
View file

@ -1,14 +0,0 @@
# Copyright (C) 2012-2021 Zammad Foundation, http://zammad-foundation.org/
class Group
module Assets
extend ActiveSupport::Concern
def filter_unauthorized_attributes(attributes)
return super if UserInfo.assets.blank? || UserInfo.assets.agent?
attributes = super
attributes.slice('id', 'name', 'active')
end
end
end

1
app/models/knowledge_base.rb
View file

@ -29,7 +29,6 @@ class KnowledgeBase < ApplicationModel
validates :color_highlight, presence: true, color: true
validates :color_header, presence: true, color: true
validates :color_header_link, presence: true, color: true
validates :iconset, inclusion: { in: KnowledgeBase::ICONSETS }

20
app/models/object_manager/attribute.rb
View file

@ -678,7 +678,7 @@ to send no browser reload event, pass false
=begin
where attributes are used in conditions
where attributes are used by triggers, overviews or schedulers
result = ObjectManager::Attribute.attribute_to_references_hash
@ -696,12 +696,9 @@ where attributes are used in conditions
=end
def self.attribute_to_references_hash
objects = Trigger.select(:name, :condition) + Overview.select(:name, :condition) + Job.select(:name, :condition)
attribute_list = {}
attribute_to_references_hash_objects
.map { |elem| elem.select(:name, :condition) }
.flatten
.each do |item|
objects.each do |item|
item.condition.each do |condition_key, _condition_attributes|
attribute_list[condition_key] ||= {}
attribute_list[condition_key][item.class.name] ||= []
@ -710,22 +707,11 @@ where attributes are used in conditions
attribute_list[condition_key][item.class.name].push item.name
end
end
attribute_list
end
=begin
models that may reference attributes
=end
def self.attribute_to_references_hash_objects
Models.all.keys.select { |elem| elem.include? ChecksConditionValidation }
end
=begin
is certain attribute used by triggers, overviews or schedulers
ObjectManager::Attribute.attribute_used_by_references?('Ticket', 'attribute_name')

2
app/models/object_manager/element/backend.rb
View file

@ -43,7 +43,7 @@ class ObjectManager::Element::Backend
end
def screens
@screens ||= attribute.screens.transform_values do |permission_options|
attribute.screens.transform_values do |permission_options|
screen_value(permission_options)
end
end

7
app/models/organization/assets.rb
View file

@ -70,12 +70,5 @@ returns
end
data
end
def filter_unauthorized_attributes(attributes)
return super if UserInfo.assets.blank? || UserInfo.assets.agent?
attributes = super
attributes.slice('id', 'name', 'active')
end
end
end

12
app/models/package.rb
View file

@ -263,7 +263,6 @@ subsequently in a separate step.
)
end
Transaction.execute do
# store package
if !data[:reinstall]
package_db = Package.create(meta)
@ -279,10 +278,6 @@ subsequently in a separate step.
# write files
package['files'].each do |file|
if !allowed_file_path?(file['location'])
raise "Can't create file, because of not allowed file location: #{file['location']}!"
end
permission = file['permission'] || '644'
content = Base64.decode64(file['content'])
_write_file(file['location'], permission, content)
@ -291,9 +286,9 @@ subsequently in a separate step.
# update package state
package_db.state = 'installed'
package_db.save
end
# prebuild assets
package_db
end
@ -488,9 +483,4 @@ execute all pending package migrations at once
true
end
def self.allowed_file_path?(file)
file.exclude?('..') && file.exclude?('%2e%2e')
end
private_class_method :allowed_file_path?
end

1
app/models/report/profile.rb
View file

@ -2,7 +2,6 @@
class Report::Profile < ApplicationModel
self.table_name = 'report_profiles'
include ChecksConditionValidation
validates :name, presence: true
store :condition

8
app/models/role/assets.rb
View file

@ -60,13 +60,5 @@ returns
end
data
end
def filter_unauthorized_attributes(attributes)
return super if UserInfo.assets.blank? || UserInfo.assets.agent?
attributes = super
attributes['name'] = "Role_#{id}"
attributes.slice('id', 'name', 'group_ids', 'permission_ids', 'active')
end
end
end

17
app/models/user.rb
View file

@ -926,16 +926,17 @@ try to find correct name
end
# check if login already exists
base_login = login.downcase.strip
alternatives = [nil] + Array(1..20) + [ SecureRandom.uuid ]
alternatives.each do |suffix|
self.login = "#{base_login}#{suffix}"
self.login = login.downcase.strip
check = true
while check
exists = User.find_by(login: login)
return true if !exists || exists.id == id
if exists && exists.id != id
self.login = "#{login}#{rand(999)}" # rubocop:disable Zammad/ForbidRand
else
check = false
end
raise Exceptions::UnprocessableEntity, "Invalid user login generation for login #{login}!"
end
true
end
def check_mail_delivery_failed

15
app/models/user/assets.rb
View file

@ -110,20 +110,5 @@ returns
end
data
end
def filter_unauthorized_attributes(attributes)
return super if UserInfo.assets.blank? || UserInfo.assets.agent?
# customer assets for the user session
if UserInfo.current_user_id == id
attributes = super
attributes.except!('web', 'phone', 'mobile', 'fax', 'department', 'street', 'zip', 'city', 'country', 'address', 'note')
return attributes
end
# customer assets for other user
attributes = super
attributes.slice('id', 'firstname', 'lastname', 'image', 'image_source', 'active')
end
end
end

1
app/policies/setting_policy.rb
View file

@ -13,7 +13,6 @@ class SettingPolicy < ApplicationPolicy
private
def permitted?
return false if record.preferences[:protected]
return true if !record.preferences[:permission]
user.permissions?(record.preferences[:permission])

9
app/policies/ticket_policy/base_scope.rb
View file

@ -13,7 +13,7 @@ class TicketPolicy < ApplicationPolicy
super
end
def resolve # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
def resolve # rubocop:disable Metrics/AbcSize
raise NoMethodError, <<~ERR.chomp if instance_of?(TicketPolicy::BaseScope)
specify an access type using a subclass of TicketPolicy::BaseScope
ERR
@ -26,7 +26,6 @@ class TicketPolicy < ApplicationPolicy
bind.push(user.group_ids_access(self.class::ACCESS_TYPE))
end
if user.permissions?('ticket.customer')
if user.organization&.shared
sql.push('(tickets.customer_id = ? OR tickets.organization_id = ?)')
bind.push(user.id, user.organization.id)
@ -34,12 +33,6 @@ class TicketPolicy < ApplicationPolicy
sql.push('tickets.customer_id = ?')
bind.push(user.id)
end
end
# The report permission can access all tickets.
if sql.empty? && !user.permissions?('report')
sql.push '0 = 1' # Forbid unlimited access for all other permissions.
end
scope.where sql.join(' OR '), *bind
end

5
app/policies/user_policy.rb
View file

@ -13,14 +13,11 @@ class UserPolicy < ApplicationPolicy
end
def update?
# full access for admins
return true if user.permissions?('admin.user')
# forbid non-agents to change users
return false if !user.permissions?('ticket.agent')
# allow agents to change customers only
return false if record.permissions?(['admin.user', 'ticket.agent'])
# allow agents to change customers
record.permissions?('ticket.customer')
end

4
app/views/knowledge_base/public/_inline_stylesheet.html.erb
View file

@ -28,8 +28,4 @@
.header {
background-color: <%= knowledge_base.color_header %>;
}
.header .menu-item {
color: <%= knowledge_base.color_header_link %>;
}
</style>

2
config/initializers/html_sanitizer.rb
View file

@ -5,11 +5,11 @@ Rails.application.config.html_sanitizer_tags_remove_content = %w[
style
comment
meta
script
]
# content of this tags will will be inserted html quoted
Rails.application.config.html_sanitizer_tags_quote_content = %w[
script
]
# only this tags are allowed

2
config/initializers/inflections.rb
View file

@ -21,7 +21,7 @@ ActiveSupport::Inflector.inflections(:en) do |inflect|
# Rails thinks the singularized version of knowledge_bases is knowledge_basis?!
# see: KnowledgeBase.table_name.singularize
inflect.irregular 'base', 'bases'
inflect.singular(%r{(knowledge_base)s$}i, '\1')
inflect.acronym 'SMIME'
inflect.acronym 'GitLab'
inflect.acronym 'GitHub'

5
contrib/packager.io/functions
View file

@ -228,7 +228,7 @@ function create_webserver_config () {
function setup_elasticsearch () {
echo "# Configuring Elasticsearch..."
ES_CONNECTION="$(zammad run rails r "puts '',Setting.get('es_url')"| tail -n 1 2>> /dev/null)"
ES_CONNECTION="$(zammad run rails r "puts Setting.get('es_url')"| tail -n 1 2>> /dev/null)"
if [ -z "${ES_CONNECTION}" ]; then
echo "-- Nevermind, no es_url is set, leaving Elasticsearch untouched ...!"
@ -273,9 +273,6 @@ function elasticsearch_searchindex_rebuild () {
function update_or_install () {
echo "# Clear cache..."
zammad run rails r Cache.clear
if [ -f ${ZAMMAD_DIR}/config/database.yml ]; then
update_database

1
db/migrate/20190531180304_initialize_knowledge_base.rb
View file

@ -10,7 +10,6 @@ class InitializeKnowledgeBase < ActiveRecord::Migration[5.0]
t.string :color_highlight, limit: 25, null: false
t.string :color_header, limit: 25, null: false
t.string :color_header_link, limit: 25, null: false
t.string :homepage_layout, null: false
t.string :category_layout, null: false

6
db/migrate/20210128131507_init_core_workflow.rb
View file

@ -75,8 +75,6 @@ class InitCoreWorkflow < ActiveRecord::Migration[5.2]
def fix_pending_time
pending_time = ObjectManager::Attribute.find_by(name: 'pending_time', object_lookup: ObjectLookup.find_by(name: 'Ticket'))
return if pending_time.blank?
pending_time.data_option.delete('required_if')
pending_time.data_option.delete('shown_if')
pending_time.save
@ -85,8 +83,6 @@ class InitCoreWorkflow < ActiveRecord::Migration[5.2]
def fix_organization_screens
%w[domain note].each do |name|
field = ObjectManager::Attribute.find_by(name: name, object_lookup: ObjectLookup.find_by(name: 'Organization'))
next if field.blank?
field.screens['create'] ||= {}
field.screens['create']['-all-'] ||= {}
field.screens['create']['-all-']['null'] = true
@ -97,8 +93,6 @@ class InitCoreWorkflow < ActiveRecord::Migration[5.2]
def fix_user_screens
%w[email web phone mobile organization_id fax department street zip city country address password vip note role_ids].each do |name|
field = ObjectManager::Attribute.find_by(name: name, object_lookup: ObjectLookup.find_by(name: 'User'))
next if field.blank?
field.screens['create'] ||= {}
field.screens['create']['-all-'] ||= {}
field.screens['create']['-all-']['null'] = true

15
db/migrate/20210830174638_maintenance_improve_setting_preferences.rb
View file

@ -1,15 +0,0 @@
# Copyright (C) 2012-2021 Zammad Foundation, http://zammad-foundation.org/
class MaintenanceImproveSettingPreferences < ActiveRecord::Migration[6.0]
def change
return if !Setting.exists?(name: 'system_init_done')
protected_settings = %w[application_secret]
protected_settings.each do |name|
setting = Setting.find_by(name: name)
setting.preferences[:protected] = true
setting.save!
end
end
end

4
db/migrate/20210921112300_issue_3751_missing_workflow_screens.rb
View file

@ -11,8 +11,6 @@ class Issue3751MissingWorkflowScreens < ActiveRecord::Migration[6.0]
def fix_organization_screens_create
%w[name shared domain_assignment active].each do |name|
field = ObjectManager::Attribute.find_by(name: name, object_lookup: ObjectLookup.find_by(name: 'Organization'))
next if field.blank?
field.screens['create'] ||= {}
field.screens['create']['-all-'] ||= {}
field.screens['create']['-all-']['null'] = false
@ -23,8 +21,6 @@ class Issue3751MissingWorkflowScreens < ActiveRecord::Migration[6.0]
def fix_user_screens_create
%w[firstname lastname active].each do |name|
field = ObjectManager::Attribute.find_by(name: name, object_lookup: ObjectLookup.find_by(name: 'User'))
next if field.blank?
field.screens['create'] ||= {}
field.screens['create']['-all-'] ||= {}
field.screens['create']['-all-']['null'] = false

11
db/migrate/20210923172256_issue_2619_kb_header_link_color.rb
View file

@ -1,11 +0,0 @@
# Copyright (C) 2012-2021 Zammad Foundation, http://zammad-foundation.org/
class Issue2619KbHeaderLinkColor < ActiveRecord::Migration[6.0]
def up
return if !Setting.exists?(name: 'system_init_done')
add_column :knowledge_bases, :color_header_link, :string, limit: 25, null: false, default: 'hsl(206,8%,50%)'
change_column_default :knowledge_bases, :color_header_link, nil
KnowledgeBase.reset_column_information
end
end

11
db/migrate/20210929161701_reload_after_core_workflow.rb
View file

@ -1,11 +0,0 @@
# Copyright (C) 2012-2021 Zammad Foundation, http://zammad-foundation.org/
class ReloadAfterCoreWorkflow < ActiveRecord::Migration[6.0]
def up
# return if it's a new setup
return if !Setting.exists?(name: 'system_init_done')
AppVersion.set(true, 'app_version')
end
end

11
db/migrate/20211004111501_reload_after_core_workflow_again.rb
View file

@ -1,11 +0,0 @@
# Copyright (C) 2012-2021 Zammad Foundation, http://zammad-foundation.org/
class ReloadAfterCoreWorkflowAgain < ActiveRecord::Migration[6.0]
def up
# return if it's a new setup
return if !Setting.exists?(name: 'system_init_done')
AppVersion.set(true, 'app_version')
end
end

11
db/migrate/20211005110047_issue3787_fix_job.rb
View file

@ -1,11 +0,0 @@
# Copyright (C) 2012-2021 Zammad Foundation, http://zammad-foundation.org/
class Issue3787FixJob < ActiveRecord::Migration[6.0]
def change
# return if it's a new setup
return if !Setting.exists?(name: 'system_init_done')
Scheduler.find_by(name: 'Delete old upload cache entries.').update(error_message: nil, status: nil, active: true)
end
end

1
db/seeds/settings.rb
View file

@ -9,7 +9,6 @@ Setting.create_if_not_exists(
state: SecureRandom.hex(128),
preferences: {
permission: ['admin'],
protected: true,
},
frontend: false
)

23
lib/fill_db.rb
View file

@ -1,5 +1,7 @@
# Copyright (C) 2012-2021 Zammad Foundation, http://zammad-foundation.org/
require 'faker'
# rubocop:disable Rails/Output
module FillDb
@ -53,7 +55,7 @@ or if you only want to create 100 tickets
else
(1..organizations).each do
ActiveRecord::Base.transaction do
organization = Organization.create!(name: "FillOrganization::#{counter}", active: true)
organization = Organization.create!(name: "FillOrganization::#{Faker::Number.number(digits: 6)}", active: true)
organization_pool.push organization
end
end
@ -70,7 +72,7 @@ or if you only want to create 100 tickets
(1..agents).each do
ActiveRecord::Base.transaction do
suffix = counter.to_s
suffix = Faker::Number.number(digits: 5).to_s
user = User.create_or_update(
login: "filldb-agent-#{suffix}",
firstname: "agent #{suffix}",
@ -100,7 +102,7 @@ or if you only want to create 100 tickets
(1..customers).each do
ActiveRecord::Base.transaction do
suffix = counter.to_s
suffix = Faker::Number.number(digits: 5).to_s
organization = nil
if organization_pool.present? && true_or_false.sample
organization = organization_pool.sample
@ -130,7 +132,7 @@ or if you only want to create 100 tickets
else
(1..groups).each do
ActiveRecord::Base.transaction do
group = Group.create!(name: "FillGroup::#{counter}", active: true)
group = Group.create!(name: "FillGroup::#{Faker::Number.number(digits: 6)}", active: true)
group_pool.push group
Role.where(name: 'Agent').first.users.where(active: true).each do |user|
user_groups = user.groups
@ -148,7 +150,7 @@ or if you only want to create 100 tickets
(1..overviews).each do
ActiveRecord::Base.transaction do
Overview.create!(
name: "Filloverview::#{counter}",
name: "Filloverview::#{Faker::Number.number(digits: 6)}",
role_ids: [Role.find_by(name: 'Agent').id],
condition: {
'ticket.state_id' => {
@ -183,7 +185,7 @@ or if you only want to create 100 tickets
customer = customer_pool.sample
agent = agent_pool.sample
ticket = Ticket.create!(
title: "some title äöüß#{counter}",
title: "some title äöüß#{Faker::Number.number(digits: 6)}",
group: group_pool.sample,
customer: customer,
owner: agent,
@ -198,8 +200,8 @@ or if you only want to create 100 tickets
ticket_id: ticket.id,
from: customer.email,
to: 'some_recipient@example.com',
subject: "some subject#{counter}",
message_id: "some@id-#{counter}",
subject: "some subject#{Faker::Number.number(digits: 6)}",
message_id: "some@id-#{Faker::Number.number(digits: 6)}",
body: 'some message ...',
internal: false,
sender: Ticket::Article::Sender.where(name: 'Customer').first,
@ -212,10 +214,5 @@ or if you only want to create 100 tickets
end
end
end
def self.counter
@counter ||= SecureRandom.random_number(1_000_000)
@counter += 1
end
end
# rubocop:enable Rails/Output

6
lib/github/http_client.rb
View file

@ -1,14 +1,12 @@
# Copyright (C) 2012-2021 Zammad Foundation, http://zammad-foundation.org/
require 'uri'
class GitHub
class HttpClient
attr_reader :api_token, :endpoint
def initialize(endpoint, api_token)
raise 'api_token required' if api_token.blank?
raise 'endpoint required' if endpoint.blank? || endpoint.exclude?('/graphql') || endpoint.scan(URI::DEFAULT_PARSER.make_regexp).blank?
raise 'endpoint required' if endpoint.blank?
@api_token = api_token
@endpoint = endpoint
@ -32,7 +30,7 @@ class GitHub
if !response.success?
Rails.logger.error response.error
raise 'GitHub request failed! Please have a look at the log file for details'
raise "Error while requesting GitHub GraphQL API: #{response.error}"
end
response.data

6
lib/gitlab/http_client.rb
View file

@ -1,14 +1,12 @@
# Copyright (C) 2012-2021 Zammad Foundation, http://zammad-foundation.org/
require 'uri'
class GitLab
class HttpClient
attr_reader :api_token, :endpoint
def initialize(endpoint, api_token)
raise 'api_token required' if api_token.blank?
raise 'endpoint required' if endpoint.blank? || endpoint.exclude?('/graphql') || endpoint.scan(URI::DEFAULT_PARSER.make_regexp).blank?
raise 'endpoint required' if endpoint.blank?
@api_token = api_token
@endpoint = endpoint
@ -32,7 +30,7 @@ class GitLab
if !response.success?
Rails.logger.error response.error
raise 'GitLab request failed! Please have a look at the log file for details'
raise "Error while requesting GitLab GraphQL API: #{response.error}"
end
response.data

2
lib/html_sanitizer.rb
View file

@ -162,7 +162,7 @@ satinize html string based on whiltelist
if node.is_a?(Nokogiri::XML::Text) && node.content.present? && node.content.include?(':') && node.ancestors.map(&:name).exclude?('a')
urls = URI.extract(node.content, LINKABLE_URL_SCHEMES)
.map { |u| u.sub(%r{[,.]$}, '') } # URI::extract captures trailing dots/commas
.grep_v(%r{^[^:]+:$}) # URI::extract will match, e.g., 'tel:'
.reject { |u| u.match?(%r{^[^:]+:$}) } # URI::extract will match, e.g., 'tel:'
next if urls.blank?

9
lib/notification_factory/mailer.rb
View file

@ -324,8 +324,7 @@ returns
locale: data[:locale],
timezone: data[:timezone],
template: template[:subject],
escape: false,
trusted: true,
escape: false
).render
# strip off the extra newline at the end of the subject to avoid =0A suffixes (see #2726)
@ -335,8 +334,7 @@ returns
objects: data[:objects],
locale: data[:locale],
timezone: data[:timezone],
template: template[:body],
trusted: true,
template: template[:body]
).render
if !data[:raw]
@ -350,8 +348,7 @@ returns
objects: data[:objects],
locale: data[:locale],
timezone: data[:timezone],
template: application_template,
trusted: true,
template: application_template
).render
end
{

11
lib/notification_factory/renderer.rb
View file

@ -13,8 +13,7 @@ examples how to use
locale: 'de-de',
timezone: 'America/Port-au-Prince',
template: 'some template <b>#{ticket.title}</b> {config.fqdn}',
escape: false,
trusted: false, # Allow ERB tags in the template?
escape: false
).render
message_body = NotificationFactory::Renderer.new(
@ -28,20 +27,16 @@ examples how to use
=end
def initialize(objects:, template:, locale: nil, timezone: nil, escape: true, trusted: false) # rubocop:disable Metrics/ParameterLists
def initialize(objects:, template:, locale: nil, timezone: nil, escape: true)
@objects = objects
@locale = locale || Locale.default
@timezone = timezone || Setting.get('timezone_default')
@template = NotificationFactory::Template.new(template, escape, trusted)
@template = NotificationFactory::Template.new(template, escape)
@escape = escape
end
def render
ERB.new(@template.to_s).result(binding)
rescue Exception => e # rubocop:disable Lint/RescueException
raise StandardError, e.message if e.is_a? SyntaxError
raise
end
# d - data of object

9
lib/notification_factory/slack.rb
View file

@ -46,16 +46,14 @@ returns
locale: data[:locale],
timezone: data[:timezone],
template: template[:subject],
escape: false,
trusted: true
escape: false
).render
message_body = NotificationFactory::Renderer.new(
objects: data[:objects],
locale: data[:locale],
timezone: data[:timezone],
template: template[:body],
escape: false,
trusted: true
escape: false
).render
if !data[:raw]
@ -70,8 +68,7 @@ returns
locale: data[:locale],
timezone: data[:timezone],
template: application_template,
escape: false,
trusted: true
escape: false
).render
end
{

8
lib/notification_factory/template.rb
View file

@ -9,21 +9,17 @@ examples how to use
cleaned_template = NotificationFactory::Template.new(
'some template <b>#{ticket.title}</b> #{config.fqdn}',
true,
false, # Allow ERB tags in the template?
).to_s
=end
def initialize(template, escape, trusted)
def initialize(template, escape)
@template = template
@escape = escape
@trusted = trusted
end
def to_s
result = @template
result.gsub!(%r{<%(?!%)}, '<%%') if !@trusted
result.gsub(%r{\#{\s*(.*?)\s*}}m) do
@template.gsub(%r{\#{\s*(.*?)\s*}}m) do
# some browsers start adding HTML tags
# fixes https://github.com/zammad/zammad/issues/385
input_template = $1.gsub(%r{\A<.+?>\s*|\s*<.+?>\z}, '')

2
lib/session_helper.rb
View file

@ -4,7 +4,7 @@ module SessionHelper
def self.json_hash(user)
collections, assets = default_collections(user)
{
session: user.filter_unauthorized_attributes(user.filter_attributes(user.attributes)),
session: user.filter_attributes(user.attributes),
models: models(user),
collections: collections,
assets: assets,

5
lib/user_info.rb
View file

@ -7,11 +7,6 @@ module UserInfo
def self.current_user_id=(user_id)
Thread.current[:user_id] = user_id
Thread.current[:assets] = UserInfo::Assets.new(user_id)
end
def self.assets
Thread.current[:assets]
end
def self.ensure_current_user_id

52
lib/user_info/assets.rb
View file

@ -1,52 +0,0 @@
# Copyright (C) 2012-2021 Zammad Foundation, http://zammad-foundation.org/
class UserInfo::Assets
LEVEL_CUSTOMER = 1
LEVEL_AGENT = 2
LEVEL_ADMIN = 3
attr_accessor :current_user_id, :level, :filter_attributes, :user
def initialize(current_user_id)
@current_user_id = current_user_id
@user = User.find_by(id: current_user_id) if current_user_id.present?
set_level
end
def admin?
check_level?(UserInfo::Assets::LEVEL_ADMIN)
end
def agent?
check_level?(UserInfo::Assets::LEVEL_AGENT)
end
def customer?
check_level?(UserInfo::Assets::LEVEL_CUSTOMER)
end
def set_level
if user.blank?
self.level = nil
return
end
self.level = UserInfo::Assets::LEVEL_CUSTOMER
Permission.where(id: user.permissions_with_child_ids).each do |permission|
case permission.name
when %r{^admin\.}
self.level = UserInfo::Assets::LEVEL_ADMIN
break
when 'ticket.agent'
self.level = UserInfo::Assets::LEVEL_AGENT
end
end
end
def check_level?(check)
return true if user.blank?
level >= check
end
end

16
public/assets/chat/Dockerfile
View file

@ -1,16 +0,0 @@
FROM node:8-alpine
ENV GULP_DIR "/tmp/gulp"
RUN apk update && apk add bash
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
CMD bash # If you want to override CMD
RUN npm install -g gulp
COPY docker-entrypoint.sh /
# enable volume to generate build files into the hosts FS
VOLUME ["$GULP_DIR"]
# start
ENTRYPOINT ["/docker-entrypoint.sh"]

5
public/assets/chat/README.md
View file

@ -1,5 +0,0 @@
# Zammad Chat build
This folder contains a `docker` image and the required files to build the Zammad Chat from coffeescript and eco files. This workaround is required for now because of the outdated NodeJS 8 dependency.
The build process can easily be started by executing the `build.sh` file. There is nothing more to it except of having `docker` installed and running.

8
public/assets/chat/build.sh
View file

@ -1,8 +0,0 @@
#!/bin/bash
set -o errexit
set -o pipefail
docker build --no-cache -t zammad/chat-build:latest .
docker run --rm -v "$(pwd)/:/tmp/gulp" zammad/chat-build:latest

6
public/assets/chat/chat-no-jquery.coffee
View file

@ -762,11 +762,7 @@ do(window) ->
console.log('p', docType, text)
if docType is 'html'
html = document.createElement('div')
# can't log because might contain malicious content
# @log.debug 'HTML clipboard', text
sanitized = DOMPurify.sanitize(text)
@log.debug 'sanitized HTML clipboard', sanitized
html.innerHTML = sanitized
html.innerHTML = text
match = false
htmlTmp = text
regex = new RegExp('<(/w|w)\:[A-Za-z]')

352
public/assets/chat/chat-no-jquery.js
View file

File diff suppressed because one or more lines are too long

2
public/assets/chat/chat-no-jquery.min.js vendored
View file

File diff suppressed because one or more lines are too long

4
public/assets/chat/chat.coffee
View file

@ -718,9 +718,7 @@ do($ = window.jQuery, window) ->
text = text.replace(/<div><\/div>/g, '<div><br></div>')
console.log('p', docType, text)
if docType is 'html'
sanitized = DOMPurify.sanitize(text)
@log.debug 'sanitized HTML clipboard', sanitized
html = $("<div>#{sanitized}</div>")
html = $("<div>#{text}</div>")
match = false
htmlTmp = text
regex = new RegExp('<(/w|w)\:[A-Za-z]')

3
public/assets/chat/chat.css
View file

@ -314,7 +314,6 @@
line-height: 1.4em;
font-size: inherit;
-webkit-appearance: none;
-moz-appearance: none;
appearance: none;
border: none;
background: none;
@ -330,7 +329,6 @@
.zammad-chat-button {
-webkit-appearance: none;
-moz-appearance: none;
appearance: none;
font-family: inherit;
font-size: inherit;
@ -351,7 +349,6 @@
.zammad-chat-button:disabled,
.zammad-chat-input:disabled {
cursor: not-allowed;
opacity: 0.3; }
.zammad-chat-is-hidden {

354
public/assets/chat/chat.js
View file

File diff suppressed because one or more lines are too long

2
public/assets/chat/chat.min.js vendored
View file

File diff suppressed because one or more lines are too long

5
public/assets/chat/docker-entrypoint.sh
View file

@ -1,5 +0,0 @@
#!/bin/bash
cd "${GULP_DIR}" || exit
gulp js css no-jquery

Some files were not shown because too many files have changed in this diff Show more