231 Commits (31943d5713cad71d4cbdc8c6013a61625be55499)

Author	SHA1	Message	Date
Oliver Günther	d980ec8d30	Avoid running into 422 loop due to null session ... The default Rails 5 behavior is throwing an exception when a CSRF violation occurs. Since we override +handle_unverified_request+ for detecting API requests, the super behavior would be to override the current session with a null session object This results in no session cookie being created for the anonymous user and subsequent POST requests being impossible. For example, this will happen when you invalidated your cookies while on the login page and try to log in. You will remain in a 422 loop because there is no valid CSRF token. If we instead use `reset_session` only, a new session is generated, the user is logged out and reset, but the following request may issue new data into the session. https://community.openproject.com/wp/28072	6 years ago
Jens Ulferts	e58a96515c	allow setting attachments through wp post/patch	7 years ago
Oliver Günther	ead0034795	Allow application controller before hook ... [ci skip]	7 years ago
ulferts	f1b1aa7839	Fix/back url when already logged in (#6166) ... * use the provided back url when already logged in But check the validity of the back_url to not be used maliciously to redirect users to pages outside our host * minor coding style improvements [ci skip]	7 years ago
Oliver Günther	6ef4211e77	Bump copyright to 2018 (#6171) ... [ci skip]	7 years ago
Oliver Günther	177f4e8963	Remove APIV2 and project associations / reportings ... [ci skip]	7 years ago
Markus Kahl	4e4ed9bbe8	verify authenticity of stage complete calls (#6014) ... * verify authenticity of stage complete calls * fixed path helper name [ci skip]	7 years ago
Markus Kahl	4b316ec470	LDAP Single Sign-on (#5888) ... * ldap sso * localise sso failure error * code climate * code climate 2 * code climate 3 * added missing login param * make spec work with SSO module prepended to ApplicationController * polish [ci skip]	7 years ago
ulferts	c0b709530c	Fix/replace deprecations (#5533) ... * replace alias_method_chain * remove deprecation silencing * bump controller-testing * introduce permitted params for settings * replace various deprecations in controllers * remove deprecation silencing for legacy_specs * remove `puts` from spec * replace deprecated access to errors * remove unnecessary AR::Parameters usage in spec * specify error to expect * replace deprecations * replace deprecated action calls in legacy function specs * replace deprecations in functional controller tests * replace deprecations in controllers/controller_specs * remove params parser which does not seem to be in effect It is registered for the content type :exclude which makes no sense as it should deal with :json. The desired behaviour of the api dealing with parsing errors is working with or without the code. * replace deprecations in unit specs * replace alias_method_chain [ci skip]	7 years ago
Oliver Günther	5d84add246	Expire sessions in warden auth scope	7 years ago
Henriette Dinger	7e1c46a6f7	Hide breadcrub per default and show in admin, my, wikHide breadcrub per default and show in admin, my, wiki	8 years ago
Oliver Günther	3580069999	Move hook to helpers ... Fixes autoloading issue	8 years ago
Oliver Günther	10f83c8bb7	[24622] Use protocol in default url_for options ... Might fix the issue described in: https://community.openproject.com/work_packages/24622	8 years ago
Oliver Günther	1eaa71d8e1	Fix cache-control	8 years ago
Oliver Günther	7cf11bb689	Update copyright notice	8 years ago
Oliver Günther	31b2862b94	[24365] Allow controllers to specify redirect-safe params	8 years ago
Jens Ulferts	5c73efc616	rely on url_for to fill in request's parameters on session timeout back url	8 years ago
Jens Ulferts	daa2d07e4b	rely on url_for to fill in request's parameters on back url	8 years ago
Oliver Günther	8c42f5ae35	Fix invalid find_project_by_project_id	8 years ago
Oliver Günther	7994631440	Use unreleased version of friendly_id and fix project finder	8 years ago
Oliver Günther	fe0e8dd919	Rename before_filter to before_action	8 years ago
Oliver Günther	638e8ca735	Build simple service to initialize setting on login	8 years ago
Jens Ulferts	ab93799c8b	improve menu performance by rendering to existing controller	8 years ago
Jens Ulferts	8c827bbbec	remove costly eager loading	8 years ago
Oliver Günther	638340e7b6	Fix rubocop issues	9 years ago
Cyril Rohr	1b29d8ec92	Move email settings out of the YAMl configuration file, and into the Settings page	9 years ago
Markus Kahl	6827c832f6	make available standard I18n's #t	9 years ago
Oliver Günther	fb4bf739d9	Allow the configuration to disable APIv2 basic auth	9 years ago
Oliver Günther	82eb512450	Make session name configurable	9 years ago
Oliver Günther	c7e410ef11	Warn users when OP cookie is missing ... When a user has disabled cookies, trying to log in to the application will result in a 422 error due to CSRF validation trying to use the session in Rails 4+. This commit introduces a separate warning when the OpenProject cookie was not found, which should always be present after the first request to the application.	9 years ago
Jens Ulferts	be21a7a504	update error message for bulk operations across multiple projects	9 years ago
Oliver Günther	a6b4372b09	Always preprocess URLs with CGI.unescape ... This forces redirect URLs to always pass through the escaping process, in order to process escaped paths (`/mysubdir/%2E%2E/secret/`).	9 years ago
Oliver Günther	fcd450af3f	Fix redirect vulnerability ... `redirect_back_or_default` was vulnerable to some of the URLs found to be vulnerable in redmine, such as `@test.foo`. This commit extracts the whole functionality into a policy and alters the constraints with a path check to avoid these cases. Thanks to @marutosi for pointing this out. http://www.redmine.org/projects/redmine/repository/revisions/14560	9 years ago
Oliver Günther	6eeea9d1da	Avoid mutator sort on relations ... https://github.com/rails/rails/pull/13314 removed mutator methods (e.g., `Array#sort!`) from relations. This commit enforces either an ordering on the query itself where applicable, or uses a non-mutator sort.	9 years ago
Jens Ulferts	6e01b27f18	rename service's method to be in accordance with proc	9 years ago
Jens Ulferts	c471080e08	set locale before API v3 request ... The mechanism was extracted from the rails stack where the locale is taken based on (in that order): * The user's preferences * The accept_language header * The system settings Only languages, that are enabled by the instance are valid. If one is selected (e.g user preference), that is not enabled by the instance, a fallback is taken.	9 years ago
Markus Kahl	dd496297fd	don't use random language as user's language ... If a user's language is not set ('') the code just used any valid language.	9 years ago
Oliver Günther	7ebac37c14	Repository Management - Refactoring and Preparation ... Related work package: [#20415](https://community.openproject.org/work_packages/20415). This is a combined refactoring and extraction effort of local SCM functionality for SVM, Git adapters in preparation for the explicit lifetime management of repositories in #20416 and implementation of (local) repository storage quota in #18393. This PR is still heavily WIP and for the time being, depends on the **legacy specs** for testing. To run the tests, execute the following steps: ~~~ rake test:scm:setup:all rake spec:legacy ~~~ I'm open for ideas on how we integrate scm adapters tests into current specs. --- - [x] Exchange `IO::Open` for `Open3` to avoid countless manual exitcode checks - [x] Extract local functionality in its own Module - [] Extend `LocalClient` module with links to create/delete services for #20415 - [x] Break down unbearable local parse routines (Hound will be over the place until fixed - but down from 260 to < 20) - [x] `entries` - [x] `revisions` - [] local repository factory - [] Specs - [] Fix / Modernize - [] More adapter-related specs	9 years ago
Alex Coles	0ad3cfb4b2	Prefer do…end for controller respond_to blocks ... `rubocop -a` does not currently normalise formatting consistently (see ec1bb39f). Signed-off-by: Alex Coles <alex@alexbcoles.com>	9 years ago
Markus Kahl	bcd981df5c	consider X-Authentication-Scheme; opt scoped realm	10 years ago
Markus Kahl	d854df5175	suppress browser prompt on authenticate failure	10 years ago
Alex Coles	e02eb0181d	Migrate AR finder/query methods in controllers ... Signed-off-by: Alex Coles <alex@alexbcoles.com>	10 years ago
Alex Coles	ec1bb39f9b	Fix syntax (w/Rubocop) in (Rails) controllers ... Signed-off-by: Alex Coles <alex@alexbcoles.com>	10 years ago
Alex Coles	57618b25ec	Replace dynamic finder usages with #find_by, etc. ... This patch replaces all dynamic finders, for the sake of consistency, although only some methods are deprecated. See: https://github.com/rails/activerecord-deprecated_finders#active-record-deprecated-finders * Revert some `User#find_by_login` usages in cuke steps accidentally removed in 74228b59. User Story # 20325 Signed-off-by: Alex Coles <alex@alexbcoles.com>	10 years ago
Alex Coles	bc5abb34ab	Remove explicit require_dependency of Principal ... This should no longer be necessary (thanks also to 8edff983). This effectively reverts 423152fa06 Signed-off-by: Alex Coles <alex@alexbcoles.com>	10 years ago
Markus Kahl	560d970b0f	in-regex comments	10 years ago
Markus Kahl	4abd716dd6	more comments	10 years ago
Markus Kahl	52fe1da137	don't redirect back to logout	10 years ago
Alex Coles	e0191e759c	Update year in copyright header to 2015 ... [ci skip]	10 years ago
Alex Coles	3629ded2ae	Handle ActionController::ParameterMissing globally ... See 6d11fac2. Signed-off-by: Alex Coles <alex@alexbcoles.com>	10 years ago