274 Commits (f96894ed51ce9f3e52516e27296b958276373325)

Author	SHA1	Message	Date
Henriette Dinger	7e1c46a6f7	Hide breadcrub per default and show in admin, my, wikHide breadcrub per default and show in admin, my, wiki	8 years ago
Oliver Günther	3580069999	Move hook to helpers ... Fixes autoloading issue	8 years ago
Oliver Günther	10f83c8bb7	[24622] Use protocol in default url_for options ... Might fix the issue described in: https://community.openproject.com/work_packages/24622	8 years ago
Oliver Günther	1eaa71d8e1	Fix cache-control	8 years ago
Oliver Günther	7cf11bb689	Update copyright notice	8 years ago
Oliver Günther	31b2862b94	[24365] Allow controllers to specify redirect-safe params	8 years ago
Jens Ulferts	5c73efc616	rely on url_for to fill in request's parameters on session timeout back url	8 years ago
Jens Ulferts	daa2d07e4b	rely on url_for to fill in request's parameters on back url	8 years ago
Oliver Günther	8c42f5ae35	Fix invalid find_project_by_project_id	8 years ago
Oliver Günther	7994631440	Use unreleased version of friendly_id and fix project finder	8 years ago
Oliver Günther	fe0e8dd919	Rename before_filter to before_action	8 years ago
Oliver Günther	638e8ca735	Build simple service to initialize setting on login	8 years ago
Jens Ulferts	ab93799c8b	improve menu performance by rendering to existing controller	8 years ago
Jens Ulferts	8c827bbbec	remove costly eager loading	8 years ago
Oliver Günther	638340e7b6	Fix rubocop issues	9 years ago
Cyril Rohr	1b29d8ec92	Move email settings out of the YAMl configuration file, and into the Settings page	9 years ago
Markus Kahl	6827c832f6	make available standard I18n's #t	9 years ago
Oliver Günther	fb4bf739d9	Allow the configuration to disable APIv2 basic auth	9 years ago
Oliver Günther	82eb512450	Make session name configurable	9 years ago
Oliver Günther	c7e410ef11	Warn users when OP cookie is missing ... When a user has disabled cookies, trying to log in to the application will result in a 422 error due to CSRF validation trying to use the session in Rails 4+. This commit introduces a separate warning when the OpenProject cookie was not found, which should always be present after the first request to the application.	9 years ago
Jens Ulferts	be21a7a504	update error message for bulk operations across multiple projects	9 years ago
Oliver Günther	a6b4372b09	Always preprocess URLs with CGI.unescape ... This forces redirect URLs to always pass through the escaping process, in order to process escaped paths (`/mysubdir/%2E%2E/secret/`).	9 years ago
Oliver Günther	fcd450af3f	Fix redirect vulnerability ... `redirect_back_or_default` was vulnerable to some of the URLs found to be vulnerable in redmine, such as `@test.foo`. This commit extracts the whole functionality into a policy and alters the constraints with a path check to avoid these cases. Thanks to @marutosi for pointing this out. http://www.redmine.org/projects/redmine/repository/revisions/14560	9 years ago
Oliver Günther	6eeea9d1da	Avoid mutator sort on relations ... https://github.com/rails/rails/pull/13314 removed mutator methods (e.g., `Array#sort!`) from relations. This commit enforces either an ordering on the query itself where applicable, or uses a non-mutator sort.	9 years ago
Jens Ulferts	6e01b27f18	rename service's method to be in accordance with proc	9 years ago
Jens Ulferts	c471080e08	set locale before API v3 request ... The mechanism was extracted from the rails stack where the locale is taken based on (in that order): * The user's preferences * The accept_language header * The system settings Only languages, that are enabled by the instance are valid. If one is selected (e.g user preference), that is not enabled by the instance, a fallback is taken.	9 years ago
Markus Kahl	dd496297fd	don't use random language as user's language ... If a user's language is not set ('') the code just used any valid language.	9 years ago
Oliver Günther	7ebac37c14	Repository Management - Refactoring and Preparation ... Related work package: [#20415](https://community.openproject.org/work_packages/20415). This is a combined refactoring and extraction effort of local SCM functionality for SVM, Git adapters in preparation for the explicit lifetime management of repositories in #20416 and implementation of (local) repository storage quota in #18393. This PR is still heavily WIP and for the time being, depends on the **legacy specs** for testing. To run the tests, execute the following steps: ~~~ rake test:scm:setup:all rake spec:legacy ~~~ I'm open for ideas on how we integrate scm adapters tests into current specs. --- - [x] Exchange `IO::Open` for `Open3` to avoid countless manual exitcode checks - [x] Extract local functionality in its own Module - [] Extend `LocalClient` module with links to create/delete services for #20415 - [x] Break down unbearable local parse routines (Hound will be over the place until fixed - but down from 260 to < 20) - [x] `entries` - [x] `revisions` - [] local repository factory - [] Specs - [] Fix / Modernize - [] More adapter-related specs	9 years ago
Alex Coles	0ad3cfb4b2	Prefer do…end for controller respond_to blocks ... `rubocop -a` does not currently normalise formatting consistently (see ec1bb39f). Signed-off-by: Alex Coles <alex@alexbcoles.com>	9 years ago
Markus Kahl	bcd981df5c	consider X-Authentication-Scheme; opt scoped realm	10 years ago
Markus Kahl	d854df5175	suppress browser prompt on authenticate failure	10 years ago
Alex Coles	e02eb0181d	Migrate AR finder/query methods in controllers ... Signed-off-by: Alex Coles <alex@alexbcoles.com>	10 years ago
Alex Coles	ec1bb39f9b	Fix syntax (w/Rubocop) in (Rails) controllers ... Signed-off-by: Alex Coles <alex@alexbcoles.com>	10 years ago
Alex Coles	57618b25ec	Replace dynamic finder usages with #find_by, etc. ... This patch replaces all dynamic finders, for the sake of consistency, although only some methods are deprecated. See: https://github.com/rails/activerecord-deprecated_finders#active-record-deprecated-finders * Revert some `User#find_by_login` usages in cuke steps accidentally removed in 74228b59. User Story # 20325 Signed-off-by: Alex Coles <alex@alexbcoles.com>	10 years ago
Alex Coles	bc5abb34ab	Remove explicit require_dependency of Principal ... This should no longer be necessary (thanks also to 8edff983). This effectively reverts 423152fa06 Signed-off-by: Alex Coles <alex@alexbcoles.com>	10 years ago
Markus Kahl	560d970b0f	in-regex comments	10 years ago
Markus Kahl	4abd716dd6	more comments	10 years ago
Markus Kahl	52fe1da137	don't redirect back to logout	10 years ago
Alex Coles	e0191e759c	Update year in copyright header to 2015 ... [ci skip]	10 years ago
Alex Coles	3629ded2ae	Handle ActionController::ParameterMissing globally ... See 6d11fac2. Signed-off-by: Alex Coles <alex@alexbcoles.com>	10 years ago
Alex Coles	bb0e6e6aa5	Fix syntax (w/Rubocop) in (Rails) controllers ... Signed-off-by: Alex Coles <alex@alexbcoles.com>	10 years ago
Alex Coles	336446c59d	Use 1.9+ Hash syntax in (Rails) controllers ... Signed-off-by: Alex Coles <alex@alexbcoles.com>	10 years ago
Richard	72b6e26461	Twist redirect to back url method to work with JSON params.	10 years ago
Martin Linkhorst	8877883c63	given openproject runs in a subdirectory we cannot allow redirecting to a different subdirectory. also tries to catch shenanigans to circumvent the check like ".." in the path.	10 years ago
Marek Takac	2269f9a8ee	Fixed authorization service calls	10 years ago
Martin Linkhorst	1f36d43b70	there was a wrong parenthesis: the last match needs to be ANDed with all the prior checks. instead of changing it, refactored the code to be more clear. still allows redirects to different sub-uris.	11 years ago
Philipp Tessenow	d8cb82a2e8	explicitly allow home path in back_url	11 years ago
Philipp Tessenow	0cdbaf39f6	fix protocol-relative redirection test ... - escape forward slash in regexp - allow redirection to home_path '/'	11 years ago
jplang	1db8642ac6	[security] fixed back url verification ... --HG-- extra : convert_revision : svn%3Ae93f8b46-1217-0410-a6f0-8f06a7374b81/trunk%4013018	11 years ago
Marek Takac	1ca62def08	Used named params in AuthorizationService constructor	11 years ago