Compare commits

..

1 Commits

Author SHA1 Message Date
Jean-Philippe Lang
0bdef7d797 tagged version 0.8.5
git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/tags/0.8.5@2886 e93f8b46-1217-0410-a6f0-8f06a7374b81
2009-09-13 12:39:40 +00:00
33 changed files with 24 additions and 268 deletions

View File

@@ -35,10 +35,6 @@ class AccountController < ApplicationController
events = Redmine::Activity::Fetcher.new(User.current, :author => @user).events(nil, nil, :limit => 10)
@events_by_day = events.group_by(&:event_date)
if @user != User.current && !User.current.admin? && @memberships.empty? && events.empty?
render_404 and return
end
rescue ActiveRecord::RecordNotFound
render_404
end
@@ -188,12 +184,12 @@ class AccountController < ApplicationController
private
def logged_user=(user)
reset_session
if user && user.is_a?(User)
User.current = user
session[:user_id] = user.id
else
User.current = User.anonymous
session[:user_id] = nil
end
end
end

View File

@@ -19,17 +19,10 @@ require 'uri'
require 'cgi'
class ApplicationController < ActionController::Base
class MissingSessionSecret < Exception ; end
layout 'base'
before_filter :user_setup, :check_if_login_required, :set_localization
filter_parameter_logging :password
if session.first[:secret].blank?
raise MissingSessionSecret, "Missing session secret. Please run 'rake config/initializers/session_store.rb' to generate one"
else
protect_from_forgery :secret => session.first[:secret]
end
include Redmine::MenuManager::MenuController
helper Redmine::MenuManager::MenuHelper
@@ -89,13 +82,7 @@ class ApplicationController < ActionController::Base
def require_login
if !User.current.logged?
# Extract only the basic url parameters on non-GET requests
if request.get?
url = url_for(params)
else
url = url_for(:controller => params[:controller], :action => params[:action], :id => params[:id], :project_id => params[:project_id])
end
redirect_to :controller => "account", :action => "login", :back_url => url
redirect_to :controller => "account", :action => "login", :back_url => url_for(params)
return false
end
true

View File

@@ -43,10 +43,6 @@ class IssuesController < ApplicationController
helper :timelog
include Redmine::Export::PDF
verify :method => :post,
:only => :destroy,
:render => { :nothing => true, :status => :method_not_allowed }
def index
retrieve_query
sort_init 'id', 'desc'
@@ -151,7 +147,6 @@ class IssuesController < ApplicationController
attach_files(@issue, params[:attachments])
flash[:notice] = l(:notice_successful_create)
Mailer.deliver_issue_add(@issue) if Setting.notified_events.include?('issue_added')
call_hook(:controller_issues_new_after_save, { :params => params, :issue => @issue})
redirect_to(params[:continue] ? { :action => 'new', :tracker_id => @issue.tracker } :
{ :action => 'show', :id => @issue })
return
@@ -199,7 +194,6 @@ class IssuesController < ApplicationController
flash[:notice] = l(:notice_successful_update)
Mailer.deliver_issue_edit(journal) if Setting.notified_events.include?('issue_updated')
end
call_hook(:controller_issues_edit_after_save, { :params => params, :issue => @issue, :time_entry => @time_entry, :journal => journal})
redirect_to(params[:back_to] || {:action => 'show', :id => @issue})
end
end

View File

@@ -88,7 +88,7 @@ class TimelogController < ApplicationController
sql << " WHERE"
sql << " (%s) AND" % @project.project_condition(Setting.display_subprojects_issues?) if @project
sql << " (%s) AND" % Project.allowed_to_condition(User.current, :view_time_entries)
sql << " (spent_on BETWEEN '%s' AND '%s')" % [ActiveRecord::Base.connection.quoted_date(@from), ActiveRecord::Base.connection.quoted_date(@to)]
sql << " (spent_on BETWEEN '%s' AND '%s')" % [ActiveRecord::Base.connection.quoted_date(@from.to_time), ActiveRecord::Base.connection.quoted_date(@to.to_time)]
sql << " GROUP BY #{sql_group_by}, tyear, tmonth, tweek, spent_on"
@hours = ActiveRecord::Base.connection.select_all(sql)

View File

@@ -159,7 +159,7 @@ module ApplicationHelper
# Truncates and returns the string as a single line
def truncate_single_line(string, *args)
truncate(string.to_s, *args).gsub(%r{[\r\n]+}m, ' ')
truncate(string, *args).gsub(%r{[\r\n]+}m, ' ')
end
def html_hours(text)

View File

@@ -10,7 +10,7 @@
<li><%=l(:field_mail)%>: <%= mail_to(h(@user.mail), nil, :encode => 'javascript') %></li>
<% end %>
<% for custom_value in @custom_values %>
<% if !custom_value.value.blank? %>
<% if !custom_value.value.empty? %>
<li><%= custom_value.custom_field.name%>: <%=h show_value(custom_value) %></li>
<% end %>
<% end %>

View File

@@ -28,7 +28,7 @@
<p><%= f.select :category_id, (@project.issue_categories.collect {|c| [c.name, c.id]}), :include_blank => true %>
<%= prompt_to_remote(l(:label_issue_category_new),
l(:label_issue_category_new), 'category[name]',
{:controller => 'projects', :action => 'add_issue_category', :id => @project, :authenticity_token => form_authenticity_token},
{:controller => 'projects', :action => 'add_issue_category', :id => @project},
:class => 'small', :tabindex => 199) if authorize_for('projects', 'add_issue_category') %></p>
<% end %>
<%= content_tag('p', f.select(:fixed_version_id,

View File

@@ -1,6 +1,6 @@
<% form_remote_tag(:url => {}, :html => { :id => "journal-#{@journal.id}-form" }) do %>
<%= text_area_tag :notes, @journal.notes, :class => 'wiki-edit',
:rows => (@journal.notes.blank? ? 10 : [[10, @journal.notes.length / 50].max, 100].min) %>
<%= text_area_tag :notes, h(@journal.notes), :class => 'wiki-edit',
:rows => (@journal.notes.blank? ? 10 : [[10, @journal.notes.length / 50].max, 100].min) %>
<%= call_hook(:view_journals_notes_form_after_notes, { :journal => @journal}) %>
<p><%= submit_tag l(:button_save) %>
<%= link_to l(:button_cancel), '#', :onclick => "Element.remove('journal-#{@journal.id}-form'); " +

View File

@@ -14,7 +14,7 @@
<td><%= link_to h(version.name), :controller => 'versions', :action => 'show', :id => version %></td>
<td align="center"><%= format_date(version.effective_date) %></td>
<td><%=h version.description %></td>
<td><%= link_to(h(version.wiki_page_title), :controller => 'wiki', :page => Wiki.titleize(version.wiki_page_title)) unless version.wiki_page_title.blank? || @project.wiki.nil? %></td>
<td><%= link_to(version.wiki_page_title, :controller => 'wiki', :page => Wiki.titleize(version.wiki_page_title)) unless version.wiki_page_title.blank? || @project.wiki.nil? %></td>
<td align="center"><%= link_to_if_authorized l(:button_edit), { :controller => 'versions', :action => 'edit', :id => version }, :class => 'icon icon-edit' %></td>
<td align="center"><%= link_to_if_authorized l(:button_delete), {:controller => 'versions', :action => 'destroy', :id => version}, :confirm => l(:text_are_you_sure), :method => :post, :class => 'icon icon-del' %></td>
</tr>

View File

@@ -11,7 +11,7 @@
<li><%=l(:field_parent)%>: <%= link_to h(@project.parent.name), :controller => 'projects', :action => 'show', :id => @project.parent %></li>
<% end %>
<% @project.custom_values.each do |custom_value| %>
<% if !custom_value.value.blank? %>
<% if !custom_value.value.empty? %>
<li><%= custom_value.custom_field.name%>: <%=h show_value(custom_value) %></li>
<% end %>
<% end %>

View File

@@ -1,7 +1,7 @@
<% @entries.each do |entry| %>
<% tr_id = Digest::MD5.hexdigest(entry.path)
depth = params[:depth].to_i %>
<tr id="<%= tr_id %>" class="<%= h params[:parent_id] %> entry <%= entry.kind %>">
<tr id="<%= tr_id %>" class="<%= params[:parent_id] %> entry <%= entry.kind %>">
<td style="padding-left: <%=18 * depth%>px;" class="filename">
<% if entry.is_dir? %>
<span class="expander" onclick="<%= remote_function :url => {:action => 'browse', :id => @project, :path => to_path_param(entry.path), :rev => @rev, :depth => (depth + 1), :parent_id => tr_id},

View File

@@ -1,4 +1,4 @@
<h2><%=l(:label_role)%>: <%=h @role.name %></h2>
<h2><%=l(:label_role)%>: <%= @role.name %></h2>
<% labelled_tabular_form_for :role, @role, :url => { :action => 'edit' }, :html => {:id => 'role_form'} do |f| %>
<%= render :partial => 'form', :locals => { :f => f } %>

View File

@@ -10,9 +10,6 @@ ul.toc { padding: 4px; margin-left: 0; }
ul.toc li { list-style-type:none; }
ul.toc li.heading2 { margin-left: 1em; }
ul.toc li.heading3 { margin-left: 2em; }
a.wiki-anchor { display: none; margin-left: 6px; text-decoration: none; }
a.wiki-anchor:hover { color: #aaa !important; text-decoration: none; }
h1:hover a.wiki-anchor, h2:hover a.wiki-anchor, h3:hover a.wiki-anchor { display: inline; color: #ddd; }
</style>
</head>
<body>

View File

@@ -6,13 +6,6 @@
<style>
body { font:80% Verdana,Tahoma,Arial,sans-serif; }
h1, h2, h3, h4 { font-family: "Trebuchet MS",Georgia,"Times New Roman",serif; }
ul.toc { padding: 4px; margin-left: 0; }
ul.toc li { list-style-type:none; }
ul.toc li.heading2 { margin-left: 1em; }
ul.toc li.heading3 { margin-left: 2em; }
a.wiki-anchor { display: none; margin-left: 6px; text-decoration: none; }
a.wiki-anchor:hover { color: #aaa !important; text-decoration: none; }
h1:hover a.wiki-anchor, h2:hover a.wiki-anchor, h3:hover a.wiki-anchor { display: inline; color: #ddd; }
</style>
</head>
<body>

View File

@@ -15,6 +15,3 @@ config.action_controller.perform_caching = false
config.action_mailer.perform_deliveries = true
config.action_mailer.delivery_method = :test
# Skip protect_from_forgery in requests http://m.onkey.org/2007/9/28/csrf-protection-for-your-existing-rails-application
config.action_controller.allow_forgery_protection = false

View File

@@ -15,7 +15,3 @@ config.action_controller.perform_caching = false
config.action_mailer.perform_deliveries = true
config.action_mailer.delivery_method = :test
# Skip protect_from_forgery in requests http://m.onkey.org/2007/9/28/csrf-protection-for-your-existing-rails-application
config.action_controller.allow_forgery_protection = false

View File

@@ -15,6 +15,3 @@ config.action_controller.perform_caching = false
config.action_mailer.perform_deliveries = true
config.action_mailer.delivery_method = :test
# Skip protect_from_forgery in requests http://m.onkey.org/2007/9/28/csrf-protection-for-your-existing-rails-application
config.action_controller.allow_forgery_protection = false

View File

@@ -4,28 +4,6 @@ Redmine - project management software
Copyright (C) 2006-2009 Jean-Philippe Lang
http://www.redmine.org/
== 2009-11-15 v0.8.7
* Fixed: Hide paragraph terminator at the end of headings on html export
* Fixed: pre tags containing "<pre*"
* Fixed: First date of the date range not included in the time report with SQLite
* Fixed: Password field not styled correctly on alternative stylesheet
* Fixed: Error when sumbitting a POST request that requires a login
* Fixed: CSRF vulnerabilities
== 2009-11-04 v0.8.6
* Change links to closed issues to be a grey color
* Change subversion adapter to not cache authentication and run non interactively
* Fixed: Custom Values with a nil value cause HTTP error 500
* Fixed: Failure to convert HTML entities when editing an Issue reply
* Fixed: Error trying to show repository when there are no comments in a changeset
* Fixed: account/show/:user_id should not be accessible for other users not in your projects
* Fixed: XSS vulnerabilities
* Fixed: IssuesController#destroy should accept POST only
* Fixed: Inline images in wiki headings
== 2009-09-13 v0.8.5

View File

@@ -30,10 +30,7 @@ Optional:
rake db:migrate RAILS_ENV="production"
It will create tables and an administrator account.
5. Generate a session store secret. Run:
rake config/initializers/session_store.rb
6. Setting up permissions
5. Setting up permissions
The user who runs Redmine must have write permission on the following
subdirectories: files, log, tmp (create the last one if not present).
@@ -42,13 +39,13 @@ Optional:
sudo chown -R redmine:redmine files log tmp
sudo chmod -R 755 files log tmp
7. Test the installation by running WEBrick web server:
6. Test the installation by running WEBrick web server:
ruby script/server -e production
Once WEBrick has started, point your browser to http://localhost:3000/
You should now see the application welcome page
8. Use default administrator account to log in:
7. Use default administrator account to log in:
login: admin
password: admin

View File

@@ -907,7 +907,7 @@ class RedCloth3 < String
end
IMAGE_RE = /
(>|\s|^) # start of line?
(<p>|\s|^) # start of line?
\! # opening
(\<|\=|\>)? # optional alignment atts
(#{C}) # optional style,class atts
@@ -1011,7 +1011,7 @@ class RedCloth3 < String
end
OFFTAGS = /(code|pre|kbd|notextile)/
OFFTAG_MATCH = /(?:(<\/#{ OFFTAGS }>)|(<#{ OFFTAGS }[^>]*>))(.*?)(?=<\/?#{ OFFTAGS }\W|\Z)/mi
OFFTAG_MATCH = /(?:(<\/#{ OFFTAGS }>)|(<#{ OFFTAGS }[^>]*>))(.*?)(?=<\/?#{ OFFTAGS }|\Z)/mi
OFFTAG_OPEN = /<#{ OFFTAGS }/
OFFTAG_CLOSE = /<\/?#{ OFFTAGS }/
HASTAG_MATCH = /(<\/?\w[^\n]*?>)/m

View File

@@ -224,7 +224,6 @@ module Redmine
str = ''
str << " --username #{shell_quote(@login)}" unless @login.blank?
str << " --password #{shell_quote(@password)}" unless @login.blank? || @password.blank?
str << " --no-auth-cache --non-interactive"
str
end
end

View File

@@ -4,7 +4,7 @@ module Redmine
module VERSION #:nodoc:
MAJOR = 0
MINOR = 8
TINY = 7
TINY = 4
# Branch values:
# * official release: nil

View File

@@ -1,24 +0,0 @@
desc 'Generates a configuration file for cookie store sessions.'
file 'config/initializers/session_store.rb' do
path = File.join(RAILS_ROOT, 'config', 'initializers', 'session_store.rb')
secret = Rails::SecretKeyGenerator.new(self).generate_secret[0,40]
File.open(path, 'w') do |f|
f.write <<"EOF"
# This file was generated by 'rake config/initializers/session_store.rb',
# and should not be made visible to public.
# If you have a load-balancing Redmine cluster, you will need to use the
# same version of this file on each machine. And be sure to restart your
# server when you modify this file.
# Your secret key for verifying cookie session data integrity. If you
# change this key, all old sessions will become invalid! Make sure the
# secret is at least 30 characters and all random, no regular words or
# you'll be exposed to dictionary attacks.
ActionController::Base.session = {
:session_key => '_redmine_session',
:secret => '#{secret}'
}
EOF
end
end

View File

@@ -69,8 +69,7 @@ function setPredecessorFieldsVisibility() {
function promptToRemote(text, param, url) {
value = prompt(text + ':');
if (value) {
var sep = (url.indexOf('?') < 0 ? '?' : '&' )
new Ajax.Request(url + sep + param + '=' + encodeURIComponent(value), {asynchronous:true, evalScripts:true});
new Ajax.Request(url + '?' + param + '=' + encodeURIComponent(value), {asynchronous:true, evalScripts:true});
return false;
}
}

View File

@@ -76,7 +76,7 @@ a, a:link, a:visited{ color: #2A5685; text-decoration: none; }
a:hover, a:active{ color: #c61a1a; text-decoration: underline;}
a img{ border: 0; }
a.issue.closed, a.issue.closed:link, a.issue.closed:visited { color: #999; text-decoration: line-through; }
a.issue.closed, a.issue.closed:link, a.issue.closed:visited { text-decoration: line-through; }
/***** Tables *****/
table.list { border: 1px solid #e4e4e4; border-collapse: collapse; width: 100%; margin-bottom: 4px; }

View File

@@ -61,9 +61,9 @@ input[type="button"], input[type="submit"], input[type="reset"] { background-col
input[type="button"]:hover, input[type="submit"]:hover, input[type="reset"]:hover { background-color: #ccccbb; }
/* Fields */
input[type="text"], input[type="password"], textarea, select { padding: 2px; border: 1px solid #d7d7d7; }
input[type="text"], input[type="password"] { padding: 3px; }
input[type="text"]:focus, input[type="password"]:focus, textarea:focus, select:focus { border: 1px solid #888866; }
input[type="text"], textarea, select { padding: 2px; border: 1px solid #d7d7d7; }
input[type="text"] { padding: 3px; }
input[type="text"]:focus, textarea:focus, select:focus { border: 1px solid #888866; }
option { border-bottom: 1px dotted #d7d7d7; }
/* Misc */

View File

@@ -96,53 +96,5 @@ users_006:
mail_notification: false
login: ''
type: AnonymousUser
users_007:
id: 7
created_on: 2006-07-19 19:33:19 +02:00
status: 1
last_login_on:
language: ''
hashed_password: 1
updated_on: 2006-07-19 19:33:19 +02:00
admin: false
mail: someone@foo.bar
lastname: One
firstname: Some
auth_source_id:
mail_notification: false
login: someone
type: User
users_008:
id: 8
created_on: 2006-07-19 19:33:19 +02:00
status: 1
last_login_on:
language: 'it'
hashed_password: 1
updated_on: 2006-07-19 19:33:19 +02:00
admin: false
mail: miscuser8@foo.bar
lastname: Misc
firstname: User
auth_source_id:
mail_notification: false
login: miscuser8
type: User
users_009:
id: 9
created_on: 2006-07-19 19:33:19 +02:00
status: 1
last_login_on:
language: 'it'
hashed_password: 1
updated_on: 2006-07-19 19:33:19 +02:00
admin: false
mail: miscuser9@foo.bar
lastname: Misc
firstname: User
auth_source_id:
mail_notification: false
login: miscuser9
type: User

View File

@@ -37,30 +37,13 @@ class AccountControllerTest < Test::Unit::TestCase
assert_template 'show'
assert_not_nil assigns(:user)
end
def test_show_should_not_fail_when_custom_values_are_nil
user = User.find(2)
# Create a custom field to illustrate the issue
custom_field = CustomField.create!(:name => 'Testing', :field_format => 'text')
custom_value = user.custom_values.build(:custom_field => custom_field).save!
get :show, :id => 2
assert_response :success
end
def test_show_inactive
get :show, :id => 5
assert_response 404
assert_nil assigns(:user)
end
def test_show_should_not_reveal_users_with_no_visible_activity_or_project
get :show, :id => 9
assert_response 404
end
def test_login_should_redirect_to_back_url_param
# request.uri is "test.host" in test environment
post :login, :username => 'jsmith', :password => 'jsmith', :back_url => 'http%3A%2F%2Ftest.host%2Fissues%2Fshow%2F1'

View File

@@ -68,16 +68,6 @@ class ProjectsControllerTest < Test::Unit::TestCase
assert_equal Project.find_by_identifier('ecookbook'), assigns(:project)
end
def test_show_should_not_fail_when_custom_values_are_nil
project = Project.find_by_identifier('ecookbook')
project.custom_values.first.update_attribute(:value, nil)
get :show, :id => 'ecookbook'
assert_response :success
assert_template 'show'
assert_not_nil assigns(:project)
assert_equal Project.find_by_identifier('ecookbook'), assigns(:project)
end
def test_private_subprojects_hidden
get :show, :id => 'ecookbook'
assert_response :success

View File

@@ -147,14 +147,6 @@ class TimelogControllerTest < Test::Unit::TestCase
assert_equal "162.90", "%.2f" % assigns(:total_hours)
end
def test_report_one_day
get :report, :project_id => 1, :columns => 'day', :from => "2007-03-23", :to => "2007-03-23", :criterias => ["member", "activity"]
assert_response :success
assert_template 'report'
assert_not_nil assigns(:total_hours)
assert_equal "4.25", "%.2f" % assigns(:total_hours)
end
def test_report_custom_field_criteria
get :report, :project_id => 1, :criterias => ['project', 'cf_1']
assert_response :success
@@ -246,14 +238,6 @@ class TimelogControllerTest < Test::Unit::TestCase
assert_equal Date.today - 7, assigns(:from)
assert_equal Date.today, assigns(:to)
end
def test_details_one_day
get :details, :project_id => 1, :from => "2007-03-23", :to => "2007-03-23"
assert_response :success
assert_template 'details'
assert_not_nil assigns(:total_hours)
assert_equal "4.25", "%.2f" % assigns(:total_hours)
end
def test_details_at_issue_level
get :details, :issue_id => 1

View File

@@ -147,24 +147,6 @@ class AccountTest < ActionController::IntegrationTest
assert user.hashed_password.blank?
end
def test_login_and_logout_should_clear_session
get '/login'
sid = session.session_id
post '/login', :username => 'admin', :password => 'admin'
assert_redirected_to 'my/page'
assert_not_equal sid, session.session_id, "login should reset session"
assert_equal 1, session[:user_id]
sid = session.session_id
get '/'
assert_equal sid, session.session_id
get '/logout'
assert_not_equal sid, session.session_id, "logout should reset session"
assert_nil session[:user_id]
end
else
puts 'Mocha is missing. Skipping tests.'
end

View File

@@ -63,10 +63,4 @@ class AdminTest < ActionController::IntegrationTest
assert_response :success
assert_template "admin/projects"
end
def test_add_a_user_as_an_anonymous_user_should_fail
post '/users/add', :user => { :login => 'psmith', :firstname => 'Paul'}, :password => "psmith09", :password_confirmation => "psmith09"
assert_response :redirect
assert_redirected_to "/login?back_url=http%3A%2F%2Fwww.example.com%2Fusers%2Fadd"
end
end

View File

@@ -79,19 +79,6 @@ class ApplicationHelperTest < HelperTestCase
to_test.each { |text, result| assert_equal "<p>#{result}</p>", textilizable(text) }
end
def test_inline_images_inside_tags
raw = <<-RAW
h1. !foo.png! Heading
Centered image:
p=. !bar.gif!
RAW
assert textilizable(raw).include?('<img src="foo.png" alt="" />')
assert textilizable(raw).include?('<img src="bar.gif" alt="" />')
end
def test_acronyms
to_test = {
'this is an acronym: GPL(General Public License)' => 'this is an acronym: <acronym title="General Public License">GPL</acronym>',
@@ -251,29 +238,7 @@ RAW
to_test.each { |text, result| assert_equal result, textilizable(text) }
end
def test_pre_tags
raw = <<-RAW
Before
<pre>
<prepared-statement-cache-size>32</prepared-statement-cache-size>
</pre>
After
RAW
expected = <<-EXPECTED
<p>Before</p>
<pre>
&lt;prepared-statement-cache-size&gt;32&lt;/prepared-statement-cache-size&gt;
</pre>
<p>After</p>
EXPECTED
assert_equal expected.gsub(%r{[\r\n\t]}, ''), textilizable(raw).gsub(%r{[\r\n\t]}, '')
end
def test_syntax_highlight
def syntax_highlight
raw = <<-RAW
<pre><code class="ruby">
# Some ruby code here