OpenProject is the leading open source project management software.
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
openproject/app/controllers/users_controller.rb

354 lines
11 KiB

#-- encoding: UTF-8
#-- copyright
# OpenProject is an open source project management software.
# Copyright (C) 2012-2021 the OpenProject GmbH
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License version 3.
#
# OpenProject is a fork of ChiliProject, which is a fork of Redmine. The copyright follows:
# Copyright (C) 2006-2013 Jean-Philippe Lang
# Copyright (C) 2010-2013 the ChiliProject Team
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
#
# See docs/COPYRIGHT.rdoc for more details.
#++
class UsersController < ApplicationController
layout 'admin'
helper_method :gon
[35507] Allow global permission to add and edit users (#8937) * Add global permission for add_user * Rename fieldset for global roles to "Global" * Add permission to admin actions * Add index action to add_user permission * Redirect to first admin item if only one * Hide status action for non admins * Break down user form into partials for easier rendering * Disable some user form tabs for non-admins * Make users API and services conformant with endpoints * Fix references to DeleteService#deletion_allowed? * Authorize add_user on show as well * Only show invite user toolbar item with permission * Fix Delete Service spec * Fix the way user prefs are handled in service * Ensure session_id is treated as string This causes a cast error otherwise as it passes rack session locally * Fix service call on onboarding controller * Fix service call on users controller * Add delete spec for global user * Hide login attribute again when adding a new user * Render auth source correctly in simple form * Fix creating invited users through service The invitation requires the mail attribute to be present. Previously, there was a manual error added to the mail. As the errors are now determined by the contract + model, we now end up with all missing properties as errors. * Properly constraint attributes for non-admins * Add specs for global user * Start working on how to update password from UsersController that code is a mess... * Change permitted_params spec to include non-admin params * Fix create user service spec * Remove mail_notification param from users controller It's not part of the contract/params passed to user * Remove todos * Extend docs * Correct the way backlogs patches into the user settings * Remove superfluous UpdateUserService * Rewrite duplicated update service examples into common shared example * Remove duplicate password writable check * Base Users::DeleteContract on base delete contract * Move checks for active users into the UserAllowedService * Restore password writable check as it is not an attribute * Fix menus for global user * Allow global users to add custom fields * Allow global user add permission to reinvite user * Fix changed var name in update service spec * Ensure also invited or registered users can be authroized This ensure that e.g., invited users can also be set as watchers * fix typo Co-authored-by: ulferts <jens.ulferts@googlemail.com>
4 years ago
before_action :authorize_global, except: %i[show deletion_info destroy]
before_action :find_user, only: %i[show
edit
update
change_status_info
change_status
destroy
deletion_info
resend_invitation]
# should also contain destroy but post data can not be redirected
before_action :require_login, only: [:deletion_info]
before_action :authorize_for_user, only: [:destroy]
[35507] Allow global permission to add and edit users (#8937) * Add global permission for add_user * Rename fieldset for global roles to "Global" * Add permission to admin actions * Add index action to add_user permission * Redirect to first admin item if only one * Hide status action for non admins * Break down user form into partials for easier rendering * Disable some user form tabs for non-admins * Make users API and services conformant with endpoints * Fix references to DeleteService#deletion_allowed? * Authorize add_user on show as well * Only show invite user toolbar item with permission * Fix Delete Service spec * Fix the way user prefs are handled in service * Ensure session_id is treated as string This causes a cast error otherwise as it passes rack session locally * Fix service call on onboarding controller * Fix service call on users controller * Add delete spec for global user * Hide login attribute again when adding a new user * Render auth source correctly in simple form * Fix creating invited users through service The invitation requires the mail attribute to be present. Previously, there was a manual error added to the mail. As the errors are now determined by the contract + model, we now end up with all missing properties as errors. * Properly constraint attributes for non-admins * Add specs for global user * Start working on how to update password from UsersController that code is a mess... * Change permitted_params spec to include non-admin params * Fix create user service spec * Remove mail_notification param from users controller It's not part of the contract/params passed to user * Remove todos * Extend docs * Correct the way backlogs patches into the user settings * Remove superfluous UpdateUserService * Rewrite duplicated update service examples into common shared example * Remove duplicate password writable check * Base Users::DeleteContract on base delete contract * Move checks for active users into the UserAllowedService * Restore password writable check as it is not an attribute * Fix menus for global user * Allow global users to add custom fields * Allow global user add permission to reinvite user * Fix changed var name in update service spec * Ensure also invited or registered users can be authroized This ensure that e.g., invited users can also be set as watchers * fix typo Co-authored-by: ulferts <jens.ulferts@googlemail.com>
4 years ago
before_action :check_if_deletion_allowed, only: %i[deletion_info
destroy]
# Password confirmation helpers and actions
include PasswordConfirmation
before_action :check_password_confirmation, only: [:destroy]
include Accounts::UserLimits
6 years ago
before_action :enforce_user_limit, only: [:create]
before_action -> { enforce_user_limit flash_now: true }, only: [:new]
include SortHelper
include CustomFieldsHelper
include PaginationHelper
def index
@groups = Group.all.sort
@status = Users::UserFilterCell.status_param params
@users = Users::UserFilterCell.filter params
respond_to do |format|
format.html do
render layout: !request.xhr?
end
end
end
def show
# show projects based on current user visibility
@memberships = @user.memberships
.where.not(project_id: nil)
.visible(current_user)
events = Activities::Fetcher.new(User.current, author: @user).events(nil, nil, limit: 10)
@events_by_day = events.group_by { |e| e.event_datetime.to_date }
if !current_user.allowed_to_globally?(:manage_user) &&
(!(@user.active? ||
@user.registered?) ||
(@user != User.current && @memberships.empty? && events.empty?))
render_404
else
respond_to do |format|
format.html { render layout: 'no_menu' }
end
end
end
def new
@user = User.new(language: Setting.default_language,
mail_notification: Setting.default_notification_option)
@auth_sources = AuthSource.all
end
def create
@user = User.new(language: Setting.default_language,
mail_notification: Setting.default_notification_option)
@user.attributes = permitted_params.user_create_as_admin(false, @user.change_password_allowed?)
@user.admin = params[:user][:admin] || false
@user.login = params[:user][:login] || @user.mail
if UserInvitation.invite_user! @user
respond_to do |format|
format.html do
flash[:notice] = I18n.t(:notice_successful_create)
redirect_to(params[:continue] ? new_user_path : edit_user_path(@user))
end
end
else
@auth_sources = AuthSource.all
respond_to do |format|
[27828] Feature: Query menu in sidenav (#6429) * in main menu add gantt as extra work package child item * Satisfy spec and code climate * Add gantt chart icon behin default gantt query name. * WIP Query menu in left sidebar * Shift query dropdown in left sidenav * Reload menu or load query on click from every project location * WIP set correct label for default queries * Query menu listens on all changes of queries (delete, create, rename, toggle starred) and updates immediatly * WIP: Inline edit, field validation * Inline Edit validation and comfirm * Inline edit: validation of duplicate name * Set default columns and sorting for static queries * Codeclimate issues fixed * WIP Inline edit validation not working perfectly in all error states * Inline edit working * Autocompleter hover disabled and hovering over categories fixed * Category hover and toggle fixed; tested in Chrome, Firefox and Opera * Placeholder cut off fixed and text wrap added * English and german wording adjusted * Styles of inline edit and menu adjusted; matching wiki page styles * prevent menus to be displayed to often * application menu only displayed on work package * specify using no_menu layout more often * adapt tests to altered production implementation * Hamburger icon only in project; on global wp page: default queries shown correctly and summary removed * searching for undefined leads to error * Accessible click fixed (listen on escape) * Gantt in top menu deleted (gantt chart is part of default queries on wp page) * load menu on wp summary page * reduce times queries are loaded * lowercase on second word * remove menu from search and home * Styles fixed (category toggle and correct highlighting) * reflect static query in url * fix autocomplete handling in specs * Open all global menus on default and hide hamburger icon on global pages; Rebuild changes that have been ovrwritten after merge" * Correct highlighting of default queries after reload * Replace summary cuke with spec * WIP * Clear up selectors * Avoid actively setting promises and instead use $state.go to load links [ci skip] * Make editable title component a little simpler We can reuse the component I built for the wiki, that wasn't present in the frontend beforehand. * Fix moving through the menu and selecting items [ci skip] * Add save button to query title when query changed * Improve static names lookup by comparing query_props * Adapt and fix specs * Allow inner scrolling of wp query results Also, style the webkit scrollbar to make it pretty where supported * Allow renaming the query through setting menu, but simply focus on field [ci skip]
6 years ago
format.html { render action: 'new' }
end
end
end
def edit
@auth_sources = AuthSource.all
@membership ||= Member.new
Placeholder user services and administration (#8944) * Adding placeholder user contracts * Adding create, update, and delete services for placeholder users * WIP: Adding Placeholder User contract specs [ci skip] * Extract contract validation into common helper * Add common validation in BaseContract + common example for admin checks * Introduce common ModelContract shared context for validations * WIP: PlaceholderUser controller, i18n, and routes [ci skip] * Placeholder users index page and query - moved all group related scopes from User to Principal to make them also available in PlaceholderUser. * end * Create PlaceholderUser * Feature spec for editing a placeholder user * Manage PlaceholderUser memberships The managment of memberships is pretty similar for User and PlaceholderUser. This commit extacts the similarities and uses them for both. * General partial and show view for PlaceholderUser * Delete obosolete partial * Allow RequireAdminGuard to be used as a module function * Fix I18n for confirmation text * Smaller code improvements * Fix: Syntax for accessing status enums was wrong. * Use UpdateService for updating a placeholder user * Add spec for PlaceholderUsersController * First code improvements after code review. - more improvements to come. * Further code improvements after review ... still more to come * Correct namespace of delete service * Fix: Make placeholder user contract validate * Remove :type attribute from base contract of User and PlaceholerUser ...and add it to the CreateContracts. Also add type validations. Further extract shared examples for placeholder user attribute validation * Refactor: Extract membership hook calls to helper * Fix redirect paths for membership controllers * Specs already present in shared exampels. * Fix duplicates routes for users and placeholder users * Fix user path * Add attribute name and lastname We don't need a writeable check as both are equally writable * Replace more references to tab_edit_user_path * Skip specs for PlaceholderUsers::DeletionService We will tackle that service in a separate PR. * Fix module usage of RequireAdminGuard * Fix group filter for placeholder users * Fix invalid reference to expect_valid * Fix: Fix tabbed edit path for placeholder users * Fix status filtering on users * Linting * Improve generalisation of individual principal filter cell - Check for presence of groups and statuses in order to toggle visibility of their UI element. - Remove groups from placeholder user controller and cell initialization and options * Fix selector on groups assign * Remove using_shared_fixtures Co-authored-by: Oliver Günther <mail@oliverguenther.de>
4 years ago
@individual_principal = @user
end
def update
[35507] Allow global permission to add and edit users (#8937) * Add global permission for add_user * Rename fieldset for global roles to "Global" * Add permission to admin actions * Add index action to add_user permission * Redirect to first admin item if only one * Hide status action for non admins * Break down user form into partials for easier rendering * Disable some user form tabs for non-admins * Make users API and services conformant with endpoints * Fix references to DeleteService#deletion_allowed? * Authorize add_user on show as well * Only show invite user toolbar item with permission * Fix Delete Service spec * Fix the way user prefs are handled in service * Ensure session_id is treated as string This causes a cast error otherwise as it passes rack session locally * Fix service call on onboarding controller * Fix service call on users controller * Add delete spec for global user * Hide login attribute again when adding a new user * Render auth source correctly in simple form * Fix creating invited users through service The invitation requires the mail attribute to be present. Previously, there was a manual error added to the mail. As the errors are now determined by the contract + model, we now end up with all missing properties as errors. * Properly constraint attributes for non-admins * Add specs for global user * Start working on how to update password from UsersController that code is a mess... * Change permitted_params spec to include non-admin params * Fix create user service spec * Remove mail_notification param from users controller It's not part of the contract/params passed to user * Remove todos * Extend docs * Correct the way backlogs patches into the user settings * Remove superfluous UpdateUserService * Rewrite duplicated update service examples into common shared example * Remove duplicate password writable check * Base Users::DeleteContract on base delete contract * Move checks for active users into the UserAllowedService * Restore password writable check as it is not an attribute * Fix menus for global user * Allow global users to add custom fields * Allow global user add permission to reinvite user * Fix changed var name in update service spec * Ensure also invited or registered users can be authroized This ensure that e.g., invited users can also be set as watchers * fix typo Co-authored-by: ulferts <jens.ulferts@googlemail.com>
4 years ago
update_params = build_user_update_params
mail_notification = update_params.delete(:mail_notification)
call = ::Users::UpdateService.new(model: @user, user: current_user).call(update_params)
[35507] Allow global permission to add and edit users (#8937) * Add global permission for add_user * Rename fieldset for global roles to "Global" * Add permission to admin actions * Add index action to add_user permission * Redirect to first admin item if only one * Hide status action for non admins * Break down user form into partials for easier rendering * Disable some user form tabs for non-admins * Make users API and services conformant with endpoints * Fix references to DeleteService#deletion_allowed? * Authorize add_user on show as well * Only show invite user toolbar item with permission * Fix Delete Service spec * Fix the way user prefs are handled in service * Ensure session_id is treated as string This causes a cast error otherwise as it passes rack session locally * Fix service call on onboarding controller * Fix service call on users controller * Add delete spec for global user * Hide login attribute again when adding a new user * Render auth source correctly in simple form * Fix creating invited users through service The invitation requires the mail attribute to be present. Previously, there was a manual error added to the mail. As the errors are now determined by the contract + model, we now end up with all missing properties as errors. * Properly constraint attributes for non-admins * Add specs for global user * Start working on how to update password from UsersController that code is a mess... * Change permitted_params spec to include non-admin params * Fix create user service spec * Remove mail_notification param from users controller It's not part of the contract/params passed to user * Remove todos * Extend docs * Correct the way backlogs patches into the user settings * Remove superfluous UpdateUserService * Rewrite duplicated update service examples into common shared example * Remove duplicate password writable check * Base Users::DeleteContract on base delete contract * Move checks for active users into the UserAllowedService * Restore password writable check as it is not an attribute * Fix menus for global user * Allow global users to add custom fields * Allow global user add permission to reinvite user * Fix changed var name in update service spec * Ensure also invited or registered users can be authroized This ensure that e.g., invited users can also be set as watchers * fix typo Co-authored-by: ulferts <jens.ulferts@googlemail.com>
4 years ago
if call.success?
9 years ago
update_email_service = UpdateUserEmailSettingsService.new(@user)
[35507] Allow global permission to add and edit users (#8937) * Add global permission for add_user * Rename fieldset for global roles to "Global" * Add permission to admin actions * Add index action to add_user permission * Redirect to first admin item if only one * Hide status action for non admins * Break down user form into partials for easier rendering * Disable some user form tabs for non-admins * Make users API and services conformant with endpoints * Fix references to DeleteService#deletion_allowed? * Authorize add_user on show as well * Only show invite user toolbar item with permission * Fix Delete Service spec * Fix the way user prefs are handled in service * Ensure session_id is treated as string This causes a cast error otherwise as it passes rack session locally * Fix service call on onboarding controller * Fix service call on users controller * Add delete spec for global user * Hide login attribute again when adding a new user * Render auth source correctly in simple form * Fix creating invited users through service The invitation requires the mail attribute to be present. Previously, there was a manual error added to the mail. As the errors are now determined by the contract + model, we now end up with all missing properties as errors. * Properly constraint attributes for non-admins * Add specs for global user * Start working on how to update password from UsersController that code is a mess... * Change permitted_params spec to include non-admin params * Fix create user service spec * Remove mail_notification param from users controller It's not part of the contract/params passed to user * Remove todos * Extend docs * Correct the way backlogs patches into the user settings * Remove superfluous UpdateUserService * Rewrite duplicated update service examples into common shared example * Remove duplicate password writable check * Base Users::DeleteContract on base delete contract * Move checks for active users into the UserAllowedService * Restore password writable check as it is not an attribute * Fix menus for global user * Allow global users to add custom fields * Allow global user add permission to reinvite user * Fix changed var name in update service spec * Ensure also invited or registered users can be authroized This ensure that e.g., invited users can also be set as watchers * fix typo Co-authored-by: ulferts <jens.ulferts@googlemail.com>
4 years ago
update_email_service.call(mail_notification: mail_notification,
self_notified: params[:self_notified] == '1',
9 years ago
notified_project_ids: params[:notified_project_ids])
if !@user.password.blank? && @user.change_password_allowed?
send_information = params[:send_information]
if @user.invited?
# setting a password for an invited user activates them implicitly
if OpenProject::Enterprise.user_limit_reached?
@user.register!
show_user_limit_warning!
else
@user.activate!
end
send_information = true
end
if @user.active? && send_information
UserMailer.account_information(@user, @user.password).deliver_later
end
end
respond_to do |format|
format.html do
flash[:notice] = I18n.t(:notice_successful_update)
redirect_back(fallback_location: edit_user_path(@user))
end
end
else
@auth_sources = AuthSource.all
@membership ||= Member.new
# Clear password input
[35507] Allow global permission to add and edit users (#8937) * Add global permission for add_user * Rename fieldset for global roles to "Global" * Add permission to admin actions * Add index action to add_user permission * Redirect to first admin item if only one * Hide status action for non admins * Break down user form into partials for easier rendering * Disable some user form tabs for non-admins * Make users API and services conformant with endpoints * Fix references to DeleteService#deletion_allowed? * Authorize add_user on show as well * Only show invite user toolbar item with permission * Fix Delete Service spec * Fix the way user prefs are handled in service * Ensure session_id is treated as string This causes a cast error otherwise as it passes rack session locally * Fix service call on onboarding controller * Fix service call on users controller * Add delete spec for global user * Hide login attribute again when adding a new user * Render auth source correctly in simple form * Fix creating invited users through service The invitation requires the mail attribute to be present. Previously, there was a manual error added to the mail. As the errors are now determined by the contract + model, we now end up with all missing properties as errors. * Properly constraint attributes for non-admins * Add specs for global user * Start working on how to update password from UsersController that code is a mess... * Change permitted_params spec to include non-admin params * Fix create user service spec * Remove mail_notification param from users controller It's not part of the contract/params passed to user * Remove todos * Extend docs * Correct the way backlogs patches into the user settings * Remove superfluous UpdateUserService * Rewrite duplicated update service examples into common shared example * Remove duplicate password writable check * Base Users::DeleteContract on base delete contract * Move checks for active users into the UserAllowedService * Restore password writable check as it is not an attribute * Fix menus for global user * Allow global users to add custom fields * Allow global user add permission to reinvite user * Fix changed var name in update service spec * Ensure also invited or registered users can be authroized This ensure that e.g., invited users can also be set as watchers * fix typo Co-authored-by: ulferts <jens.ulferts@googlemail.com>
4 years ago
@user = call.result
@errors = call.errors
@user.password = @user.password_confirmation = nil
respond_to do |format|
format.html do
render action: :edit
end
end
end
end
def change_status_info
@status_change = params[:change_action].to_sym
return render_400 unless %i(activate lock unlock).include? @status_change
end
def change_status
if @user.id == current_user.id
# user is not allowed to change own status
redirect_back_or_default(action: 'edit', id: @user)
return
end
if (params[:unlock] || params[:activate]) && user_limit_reached?
show_user_limit_error!
return redirect_back_or_default(action: 'edit', id: @user)
end
if params[:unlock]
@user.failed_login_count = 0
@user.activate
elsif params[:lock]
@user.lock
elsif params[:activate]
@user.activate
end
# Was the account activated? (do it before User#save clears the change)
was_activated = (@user.status_change == %w[registered active])
if params[:activate] && @user.missing_authentication_method?
flash[:error] = I18n.t(:error_status_change_failed,
errors: I18n.t(:notice_user_missing_authentication_method),
scope: :user)
elsif @user.save
flash[:notice] = I18n.t(:notice_successful_update)
if was_activated
UserMailer.account_activated(@user).deliver_later
end
else
flash[:error] = I18n.t(:error_status_change_failed,
errors: @user.errors.full_messages.join(', '),
scope: :user)
end
redirect_back_or_default(action: 'edit', id: @user)
end
def resend_invitation
status = Principal.statuses[:invited]
@user.update status: status if @user.status != status
token = UserInvitation.reinvite_user @user.id
if token.persisted?
flash[:notice] = I18n.t(:notice_user_invitation_resent, email: @user.mail)
else
logger.error "could not re-invite #{@user.mail}: #{token.errors.full_messages.join(' ')}"
flash[:error] = I18n.t(:notice_internal_server_error, app_title: Setting.app_title)
end
redirect_to edit_user_path(@user)
end
def destroy
# true if the user deletes him/herself
self_delete = (@user == User.current)
[35507] Allow global permission to add and edit users (#8937) * Add global permission for add_user * Rename fieldset for global roles to "Global" * Add permission to admin actions * Add index action to add_user permission * Redirect to first admin item if only one * Hide status action for non admins * Break down user form into partials for easier rendering * Disable some user form tabs for non-admins * Make users API and services conformant with endpoints * Fix references to DeleteService#deletion_allowed? * Authorize add_user on show as well * Only show invite user toolbar item with permission * Fix Delete Service spec * Fix the way user prefs are handled in service * Ensure session_id is treated as string This causes a cast error otherwise as it passes rack session locally * Fix service call on onboarding controller * Fix service call on users controller * Add delete spec for global user * Hide login attribute again when adding a new user * Render auth source correctly in simple form * Fix creating invited users through service The invitation requires the mail attribute to be present. Previously, there was a manual error added to the mail. As the errors are now determined by the contract + model, we now end up with all missing properties as errors. * Properly constraint attributes for non-admins * Add specs for global user * Start working on how to update password from UsersController that code is a mess... * Change permitted_params spec to include non-admin params * Fix create user service spec * Remove mail_notification param from users controller It's not part of the contract/params passed to user * Remove todos * Extend docs * Correct the way backlogs patches into the user settings * Remove superfluous UpdateUserService * Rewrite duplicated update service examples into common shared example * Remove duplicate password writable check * Base Users::DeleteContract on base delete contract * Move checks for active users into the UserAllowedService * Restore password writable check as it is not an attribute * Fix menus for global user * Allow global users to add custom fields * Allow global user add permission to reinvite user * Fix changed var name in update service spec * Ensure also invited or registered users can be authroized This ensure that e.g., invited users can also be set as watchers * fix typo Co-authored-by: ulferts <jens.ulferts@googlemail.com>
4 years ago
Users::DeleteService.new(model: @user, user: User.current).call
flash[:notice] = I18n.t('account.deleted')
respond_to do |format|
format.html do
redirect_to self_delete ? signin_path : users_path
end
end
end
def deletion_info
render action: 'deletion_info', layout: my_or_admin_layout
end
private
def find_user
if params[:id] == 'current' || params['id'].nil?
require_login || return
@user = User.current
else
@user = User.find(params[:id])
end
rescue ActiveRecord::RecordNotFound
render_404
end
def authorize_for_user
if (User.current != @user ||
User.current == User.anonymous) &&
!User.current.admin?
respond_to do |format|
[27828] Feature: Query menu in sidenav (#6429) * in main menu add gantt as extra work package child item * Satisfy spec and code climate * Add gantt chart icon behin default gantt query name. * WIP Query menu in left sidebar * Shift query dropdown in left sidenav * Reload menu or load query on click from every project location * WIP set correct label for default queries * Query menu listens on all changes of queries (delete, create, rename, toggle starred) and updates immediatly * WIP: Inline edit, field validation * Inline Edit validation and comfirm * Inline edit: validation of duplicate name * Set default columns and sorting for static queries * Codeclimate issues fixed * WIP Inline edit validation not working perfectly in all error states * Inline edit working * Autocompleter hover disabled and hovering over categories fixed * Category hover and toggle fixed; tested in Chrome, Firefox and Opera * Placeholder cut off fixed and text wrap added * English and german wording adjusted * Styles of inline edit and menu adjusted; matching wiki page styles * prevent menus to be displayed to often * application menu only displayed on work package * specify using no_menu layout more often * adapt tests to altered production implementation * Hamburger icon only in project; on global wp page: default queries shown correctly and summary removed * searching for undefined leads to error * Accessible click fixed (listen on escape) * Gantt in top menu deleted (gantt chart is part of default queries on wp page) * load menu on wp summary page * reduce times queries are loaded * lowercase on second word * remove menu from search and home * Styles fixed (category toggle and correct highlighting) * reflect static query in url * fix autocomplete handling in specs * Open all global menus on default and hide hamburger icon on global pages; Rebuild changes that have been ovrwritten after merge" * Correct highlighting of default queries after reload * Replace summary cuke with spec * WIP * Clear up selectors * Avoid actively setting promises and instead use $state.go to load links [ci skip] * Make editable title component a little simpler We can reuse the component I built for the wiki, that wasn't present in the frontend beforehand. * Fix moving through the menu and selecting items [ci skip] * Add save button to query title when query changed * Improve static names lookup by comparing query_props * Adapt and fix specs * Allow inner scrolling of wp query results Also, style the webkit scrollbar to make it pretty where supported * Allow renaming the query through setting menu, but simply focus on field [ci skip]
6 years ago
format.html { render_403 }
format.xml { head :unauthorized, 'WWW-Authenticate' => 'Basic realm="OpenProject API"' }
format.js { head :unauthorized, 'WWW-Authenticate' => 'Basic realm="OpenProject API"' }
format.json { head :unauthorized, 'WWW-Authenticate' => 'Basic realm="OpenProject API"' }
end
false
end
end
def check_if_deletion_allowed
[35507] Allow global permission to add and edit users (#8937) * Add global permission for add_user * Rename fieldset for global roles to "Global" * Add permission to admin actions * Add index action to add_user permission * Redirect to first admin item if only one * Hide status action for non admins * Break down user form into partials for easier rendering * Disable some user form tabs for non-admins * Make users API and services conformant with endpoints * Fix references to DeleteService#deletion_allowed? * Authorize add_user on show as well * Only show invite user toolbar item with permission * Fix Delete Service spec * Fix the way user prefs are handled in service * Ensure session_id is treated as string This causes a cast error otherwise as it passes rack session locally * Fix service call on onboarding controller * Fix service call on users controller * Add delete spec for global user * Hide login attribute again when adding a new user * Render auth source correctly in simple form * Fix creating invited users through service The invitation requires the mail attribute to be present. Previously, there was a manual error added to the mail. As the errors are now determined by the contract + model, we now end up with all missing properties as errors. * Properly constraint attributes for non-admins * Add specs for global user * Start working on how to update password from UsersController that code is a mess... * Change permitted_params spec to include non-admin params * Fix create user service spec * Remove mail_notification param from users controller It's not part of the contract/params passed to user * Remove todos * Extend docs * Correct the way backlogs patches into the user settings * Remove superfluous UpdateUserService * Rewrite duplicated update service examples into common shared example * Remove duplicate password writable check * Base Users::DeleteContract on base delete contract * Move checks for active users into the UserAllowedService * Restore password writable check as it is not an attribute * Fix menus for global user * Allow global users to add custom fields * Allow global user add permission to reinvite user * Fix changed var name in update service spec * Ensure also invited or registered users can be authroized This ensure that e.g., invited users can also be set as watchers * fix typo Co-authored-by: ulferts <jens.ulferts@googlemail.com>
4 years ago
render_404 unless Users::DeleteContract.deletion_allowed? @user, User.current
end
def my_or_admin_layout
# TODO: how can this be done better:
# check if the route used to call the action is in the 'my' namespace
if url_for(:delete_my_account_info) == request.url
'my'
else
'admin'
end
end
def set_password?(params)
params[:user][:password].present? && !OpenProject::Configuration.disable_password_choice?
end
protected
def default_breadcrumb
if action_name == 'index'
t('label_user_plural')
else
ActionController::Base.helpers.link_to(t('label_user_plural'), users_path)
end
end
def show_local_breadcrumb
action_name != 'show'
end
[35507] Allow global permission to add and edit users (#8937) * Add global permission for add_user * Rename fieldset for global roles to "Global" * Add permission to admin actions * Add index action to add_user permission * Redirect to first admin item if only one * Hide status action for non admins * Break down user form into partials for easier rendering * Disable some user form tabs for non-admins * Make users API and services conformant with endpoints * Fix references to DeleteService#deletion_allowed? * Authorize add_user on show as well * Only show invite user toolbar item with permission * Fix Delete Service spec * Fix the way user prefs are handled in service * Ensure session_id is treated as string This causes a cast error otherwise as it passes rack session locally * Fix service call on onboarding controller * Fix service call on users controller * Add delete spec for global user * Hide login attribute again when adding a new user * Render auth source correctly in simple form * Fix creating invited users through service The invitation requires the mail attribute to be present. Previously, there was a manual error added to the mail. As the errors are now determined by the contract + model, we now end up with all missing properties as errors. * Properly constraint attributes for non-admins * Add specs for global user * Start working on how to update password from UsersController that code is a mess... * Change permitted_params spec to include non-admin params * Fix create user service spec * Remove mail_notification param from users controller It's not part of the contract/params passed to user * Remove todos * Extend docs * Correct the way backlogs patches into the user settings * Remove superfluous UpdateUserService * Rewrite duplicated update service examples into common shared example * Remove duplicate password writable check * Base Users::DeleteContract on base delete contract * Move checks for active users into the UserAllowedService * Restore password writable check as it is not an attribute * Fix menus for global user * Allow global users to add custom fields * Allow global user add permission to reinvite user * Fix changed var name in update service spec * Ensure also invited or registered users can be authroized This ensure that e.g., invited users can also be set as watchers * fix typo Co-authored-by: ulferts <jens.ulferts@googlemail.com>
4 years ago
def build_user_update_params
pref_params = permitted_params.pref.to_h
update_params = permitted_params
.user_create_as_admin(@user.uses_external_authentication?, @user.change_password_allowed?)
.to_h
.merge(pref: pref_params)
return update_params unless @user.change_password_allowed?
if params[:user][:assign_random_password]
password = OpenProject::Passwords::Generator.random_password
update_params.merge!(
password: password,
password_confirmation: password,
force_password_change: true
)
elsif set_password? params
update_params.merge!(
password: params[:user][:password],
password_confirmation: params[:user][:password_confirmation]
)
end
update_params
end
end