53582 Commits (c194da3cd7701bc2f9913c0157dbe85f2e587cf6)

 

All Branches   

Search

Author	SHA1	Message	Date
Oliver Günther	91ecb3ba1e	Fix resetting the session for non-html requests ... this caused a CSRF issue on saas. Requests were being redirected to /admin/subscriptions/expired and wrongfully so for API and CSS requests. Now imagine a request to `/` with `login_required` for a non-logged in user 1. The GET `/` request is redirected to `/login?back_url=...` by ApplicationController. Session is reset here to X 2. The user receives the login form with CSRF value from session X 3. A request is made to `/api/v3/configuration` from the frontend. It too is redirected to a Rails controller and ends up in the same `check_if_login_required` flow, resetting the session again 4. The user now has a session cookie Y, but the CSRF form is still from X 5. submitting it results in 422 CSRF validation error	5 years ago
ulferts	720565a4ac	adapt spec to changes in delayed	5 years ago
Oliver Günther	3150ad6c69	Bump dev branch ... [ci skip]	5 years ago
ulferts	1f071a1d79	Merge pull request #7854 from opf/fix/31609/make-system-user-active ... [31609] Make system user active	5 years ago
Oliver Günther	51e8387e78	Remove builtin status ... [ci skip]	5 years ago
ulferts	25ac805ac3	Merge branch 'release/10.1' into dev	5 years ago
ulferts	87eac68ce3	attempt to stabilize flickering spec	5 years ago
Oliver Günther	020b5100ca	Merge pull request #7856 from opf/fix/bump_loofah ... bump loofah because of CVE [ci skip]	5 years ago
Oliver Günther	33454926e2	Merge pull request #7855 from opf/fix/default_order_regex ... increase strictness on regexp for default orders [ci skip]	5 years ago
Oliver Günther	56a75602a6	[31609] Make system user active	5 years ago
ulferts	9e2f651d4a	bump loofah because of CVE ... https://nvd.nist.gov/vuln/detail/CVE-2019-15587	5 years ago
ulferts	00a31728fc	increase strictness on regexp for default orders ... Otherwise partial matches would also count e.g. is_public matches as public is a substring.	5 years ago
Oliver Günther	7673dd5dd2	Merge pull request #7846 from opf/fix/n+1_queries_on_wp_form ... Fix/n+1 queries on wp form [ci skip]	5 years ago
Oliver Günther	8fe51ea9e3	Merge pull request #7852 from opf/fix/copy_project_button_permission_check ... only require copy_project permission to show button [ci skip]	5 years ago
Markus Kahl	c98a8ea33c	Merge pull request #7853 from opf/fix/hook-exceptions ... Don't break application if a hook fails	5 years ago
Oliver Günther	5c858815d9	Merge pull request #7851 from opf/fix/notification_box_position ... move notification box higher [ci skip]	5 years ago
Oliver Günther	e77162c1dd	Don't break application if a hook fails	5 years ago
ulferts	c96c5b89d5	only require copy_project permission to show button	5 years ago
ulferts	4ed1dbe7f7	rewrite legacy specs for wiki_content	5 years ago
ulferts	c80c430801	attempt to fix flickering spec	5 years ago
Oliver Günther	ee0bbcd043	Use deliver_now in test mail ... [ci skip]	5 years ago
ulferts	8d0ae7ad46	move notification box higher	5 years ago
Oliver Günther	f88d7bcf23	Merge pull request #7849 from opf/fix/bump_rspec_gems ... bump rspec gems [ci skip]	5 years ago
ulferts	1d7f013f89	rewrite legacy status specs	5 years ago
ulferts	c73fc1b772	rewrites #format_date legacy specs	5 years ago
ulferts	d12b1e52eb	rewrite codeset_util specs	5 years ago
ulferts	a8bc7b6c18	move @is_leaf resetting to different module	5 years ago
ulferts	b9b72f7204	linting	5 years ago
ulferts	9781a6eb97	adapt specs	5 years ago
ulferts	9b9ee1349a	memoize leaf? method	5 years ago
ulferts	5869966f12	relay available_custom_fields call to cacheable class method ... That way, we avoid n+1 queries for the available custom field especially in scenarios like schemas and api collections where a set of models is queried for their custom fields	5 years ago
Oliver Günther	13c8d2600d	Merge pull request #7850 from opf/fix/31596/use-pristine-resource-for-milestone ... [31596] Use pristine, not projected resource for delta building [ci skip]	5 years ago
Oliver Günther	050011272e	[31596] Use pristine, not projected resource for delta building ... The milestone delta computation must not use the projected resource, as that contains the "would-be" date to be applied. Instead the delta needs to be applied to the original date value https://community.openproject.com/wp/31596	5 years ago
ulferts	4befc236f9	bump rspec gems	5 years ago
ulferts	b1f6531a2e	Merge branch 'release/10.1' into dev	5 years ago
Oliver Günther	9392086fe9	Merge pull request #7847 from opf/fix/wp_table_cf_summing ... fix summing custom fields on wp table [ci skip]	5 years ago
Oliver Günther	74f070f8c9	Merge pull request #7848 from opf/fix/notification_registration_affecting_other_specs ... unsubscribe from OP notification to avoid affecting other specs [ci skip]	5 years ago
ulferts	a78b59d479	unsubscribe from OP notification to avoid affecting other specs	5 years ago
ulferts	f0f8f80f71	Merge pull request #7838 from opf/fix/30920/links-intask-lists ... [30920] Fix links in task lists	5 years ago
ulferts	d91a241217	Merge branch 'release/10.1' into dev	5 years ago
ulferts	aa3698d061	fix summing custom fields on wp table ... Before the fix, string values where returned and then the `+` method was called which lead to the strings being concatenated. A subsequent call of `integer?` failed. The fix performs the aggregation in the database which is not only correct then but can also be carried out considerably faster. The drawback is, that the casting breaks the abstraction introduced by the cf strategies	5 years ago
Oliver Günther	192f8e5821	Merge pull request #7842 from opf/fix/copy_subproject_without_permission ... Fix/copy subproject without permission [ci skip]	5 years ago
Oliver Günther	8f3ad5af6c	Merge pull request #7845 from opf/fix/contract_writability_side_effects ... fix contract writability check side effect [ci skip]	5 years ago
ulferts	cd3ffe0cc5	adapt specs to altered interface	5 years ago
ulferts	184c0e42be	fix contract writability check side effect	5 years ago
Travis CI User	c9bd7e0a10	update locales from crowdin [ci skip]	5 years ago
Travis CI User	fd6dcac92f	update locales from crowdin [ci skip]	5 years ago
Oliver Günther	310cbfc694	Merge pull request #7843 from opf/fix/config-invalid-yml-string ... [31583] avoid parsing strings to yaml [ci skip]	5 years ago
Oliver Günther	269d91cfb9	[31583] avoid parsing strings to yaml ... If a configuration/ENV value has YML-incompatible contents, it is broken due to the `YAML.load` approach. However, if the outcome of `YAML.load` is a string, we can expect the input to be an actual string, not something YAML should parse. Thus as a workaround until proper configuration types are added (or better, settings and configuration is joined into one), this avoids breaking passwords in ENV configuration inputs. https://community.openproject.com/wp/31583	5 years ago
Oliver Günther	4dae69305f	Merge pull request #7837 from opf/fix/stable_webhook_events ... Fix/stable webhook events [ci skip]	5 years ago