Release OpenProject 12.5.3

.github/workflows/pullpreview.yml

@@ -28,6 +28,7 @@ jobs:
         echo "OP_ADMIN_USER_SEEDER_FORCE_PASSWORD_CHANGE=off" >> .env.pullpreview
         echo "OPENPROJECT_SHOW__SETTING__MISMATCH__WARNING=false" >> .env.pullpreview
         echo "OPENPROJECT_FEATURE__STORAGES__MODULE__ACTIVE=true" >> .env.pullpreview
+        echo "OPENPROJECT_HSTS=false" >> .env.pullpreview
     - name: Boot as BIM edition
       if: contains(github.ref, 'bim/') || contains(github.head_ref, 'bim/')
       run: |

Gemfile

@@ -105,7 +105,10 @@ gem 'email_validator', '~> 2.2.3'
 gem 'json_schemer', '~> 0.2.18'
 gem 'ruby-duration', '~> 3.2.0'
 
-gem 'mail', '>= 2.8.1'
+# `config/initializers/mail_starttls_patch.rb` has also been patched to
+# fix STARTTLS handling until https://github.com/mikel/mail/pull/1536 is
+# released.
+gem 'mail', '= 2.8.1'
 
 # provide compatible filesystem information for available storage
 gem 'sys-filesystem', '~> 1.4.0', require: false

Gemfile.lock

@@ -1030,7 +1030,7 @@ DEPENDENCIES
   listen (~> 3.8.0)
   livingstyleguide (~> 2.1.0)
   lograge (~> 0.12.0)
-  mail (>= 2.8.1)
+  mail (= 2.8.1)
   matrix (~> 0.4.2)
   meta-tags (~> 2.18.0)
   mini_magick (~> 4.12.0)

app/contracts/projects/archive_contract.rb

@@ -60,9 +60,9 @@ def validate_can_archive_subprojects
       # prevent adding another error if there is already one present
       return if errors.present?
 
-      subprojects = model.descendants
-      return if subprojects.empty?
-      return if user.allowed_to?(:archive_project, subprojects)
+      active_subprojects = model.active_subprojects
+      return if active_subprojects.empty?
+      return if user.allowed_to?(:archive_project, active_subprojects)
 
       errors.add :base, :archive_permission_missing_on_subprojects
     end

app/models/enumeration.rb

@@ -29,7 +29,7 @@
 class Enumeration < ApplicationRecord
   default_scope { order("#{Enumeration.table_name}.position ASC") }
 
-  belongs_to :project
+  belongs_to :project, optional: true
 
   acts_as_list scope: 'type = \'#{type}\''
   acts_as_tree order: 'position ASC'

app/models/menu_item.rb

@@ -27,7 +27,7 @@
 #++
 
 class MenuItem < ApplicationRecord
-  belongs_to :parent, class_name: 'MenuItem'
+  belongs_to :parent, class_name: 'MenuItem', optional: true
   has_many :children, -> {
     order('id ASC')
   }, class_name: 'MenuItem', dependent: :destroy, foreign_key: :parent_id

app/models/notification_setting.rb

@@ -57,7 +57,7 @@ def self.email_settings
     ]
   end
 
-  belongs_to :project
+  belongs_to :project, optional: true
   belongs_to :user
 
   include Scopes::Scoped

app/models/project.rb

@@ -342,6 +342,11 @@ def hierarchy
     parents | descendants # Set union
   end
 
+  # Returns an array of active subprojects.
+  def active_subprojects
+    project.descendants.where(active: true)
+  end
+
   class << self
     # builds up a project hierarchy helper structure for use with #project_tree_from_hierarchy
     #

app/models/projects/exports/formatters/description.rb

@@ -0,0 +1,40 @@
+#-- copyright
+# OpenProject is an open source project management software.
+# Copyright (C) 2012-2023 the OpenProject GmbH
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License version 3.
+#
+# OpenProject is a fork of ChiliProject, which is a fork of Redmine. The copyright follows:
+# Copyright (C) 2006-2013 Jean-Philippe Lang
+# Copyright (C) 2010-2013 the ChiliProject Team
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+#
+# See COPYRIGHT and LICENSE files for more details.
+#++
+module Projects::Exports
+  module Formatters
+    class Description < ::Exports::Formatters::Default
+      def self.apply?(attribute)
+        attribute.to_sym == :description
+      end
+
+      def format(project, **)
+        Rails::Html::FullSanitizer.new.sanitize(project.description)
+      end
+    end
+  end
+end

app/models/projects/status.rb

@@ -26,7 +26,7 @@
 # See COPYRIGHT and LICENSE files for more details.
 #++
 
-class Projects::Status < ActiveRecord::Base
+class Projects::Status < ApplicationRecord
   belongs_to :project
 
   self.table_name = 'project_statuses'

app/models/type.rb

@@ -53,6 +53,7 @@ def copy_from_type(source_type)
                           association_foreign_key: 'custom_field_id'
 
   belongs_to :color,
+             optional: true,
              class_name: 'Color'
 
   acts_as_list

app/models/user.rb

@@ -54,7 +54,7 @@ class User < Principal
      inverse_of: :user
   has_one :rss_token, class_name: '::Token::RSS', dependent: :destroy
   has_one :api_token, class_name: '::Token::API', dependent: :destroy
-  belongs_to :auth_source
+  belongs_to :auth_source, optional: true
 
   # Authorized OAuth grants
   has_many :oauth_grants,
@@ -547,6 +547,7 @@ def self.anonymous
           u.mail = ''
           u.status = User.statuses[:active]
         end).save
+
         raise 'Unable to create the anonymous user.' if anonymous_user.new_record?
       end
       anonymous_user

app/models/work_package.rb

@@ -49,11 +49,11 @@ class WorkPackage < ApplicationRecord
   belongs_to :type
   belongs_to :status, class_name: 'Status'
   belongs_to :author, class_name: 'User'
-  belongs_to :assigned_to, class_name: 'Principal'
-  belongs_to :responsible, class_name: 'Principal'
-  belongs_to :version
+  belongs_to :assigned_to, class_name: 'Principal', optional: true
+  belongs_to :responsible, class_name: 'Principal', optional: true
+  belongs_to :version, optional: true
   belongs_to :priority, class_name: 'IssuePriority'
-  belongs_to :category, class_name: 'Category'
+  belongs_to :category, class_name: 'Category', optional: true
 
   has_many :time_entries, dependent: :delete_all
 

app/models/work_packages/costs.rb

@@ -30,7 +30,7 @@ module WorkPackages::Costs
   extend ActiveSupport::Concern
 
   included do
-    belongs_to :budget, inverse_of: :work_packages
+    belongs_to :budget, inverse_of: :work_packages, optional: true
     has_many :cost_entries, dependent: :delete_all
 
     # disabled for now, implements part of ticket blocking

app/services/projects/archive_service.rb

@@ -39,8 +39,8 @@ def initialize(user:, model:, contract_class: Projects::ArchiveContract)
     private
 
     def persist(service_call)
-      archive_project(model) and model.children.each do |child|
-        archive_project(child)
+      archive_project(model) and model.active_subprojects.each do |subproject|
+        archive_project(subproject)
       end
 
       service_call

app/services/users/register_user_service.rb

@@ -104,7 +104,7 @@ def register_ldap_user
     # Try to register a user with an existsing omniauth connection
     # bypassing regular account registration restrictions
     def register_omniauth_user
-      return if user.identity_url.blank?
+      return if skip_omniauth_user?
 
       user.activate
 
@@ -113,6 +113,10 @@ def register_omniauth_user
       end
     end
 
+    def skip_omniauth_user?
+      user.identity_url.blank?
+    end
+
     def register_by_email_activation
       return unless Setting::SelfRegistration.by_email?
 

bin/compose

@@ -57,12 +57,24 @@ elif [[ "$1" = "setup" ]]; then
 elif [[ "$1" = "reset" ]]; then
   $DOCKER_COMPOSE -f $COMPOSE_FILE down && docker volume rm `docker volume ls -q | grep ${PWD##*/}_`
 elif [[ "$1" = "rspec" ]]; then
-  if ! docker ps | grep ${PWD##*/}_backend-test_1 > /dev/null; then
+  function get-container-name() {
+    name=`$DOCKER_COMPOSE ps backend-test | tail -n1 | cut -d ' ' -f1`
+
+    if [ "$name" = 'NAME' ]; then
+      return 1;
+    else
+      echo "$name"
+    fi
+  }
+
+  if ! get-container-name > /dev/null; then
     echo "Test backend not running yet. Starting it..."
 
     $DOCKER_COMPOSE -f $COMPOSE_FILE up -d backend-test
 
-    while ! docker logs --since 1m ${PWD##*/}_backend-test_1 | grep "Ready for tests" > /dev/null; do
+    container=`get-container-name`
+
+    while ! docker logs --since 1m $container 2>&1 | grep "Ready for tests" &> /dev/null; do
       sleep 1
       printf "."
     done

config/application.rb

@@ -59,10 +59,15 @@ class Application < Rails::Application
     # https://guides.rubyonrails.org/configuring.html#versioned-default-values
     # for the default values associated with a particular version.
     #
-    # Currently, defaults from Rails 4.2 are applied. Goal is to reach 7.0
-    # defaults. Overridden defaults should be stored in specific initializers
-    # files. See https://community.openproject.org/wp/45463 for details.
-    # config.load_defaults 5.0
+    # Goal is to reach 7.0 defaults. Overridden defaults should be stored in
+    # specific initializers files. See
+    # https://community.openproject.org/wp/45463 for details.
+    config.load_defaults 5.0
+
+    # Do not require `belongs_to` associations to be present by default.
+    # Rails 5.0+ default is true. Because of history, lots of tests fail when
+    # set to true.
+    config.active_record.belongs_to_required_by_default = false
 
     # Use new connection handling API. For most applications this won't have any
     # effect. For applications using multiple databases, this new API provides

config/constants/settings/definition.rb

@@ -728,6 +728,18 @@ class Definition
         },
         writable: false
       },
+      remote_storage_upload_host: {
+        format: :string,
+        default: nil,
+        writable: false,
+        description: 'Host the frontend uses to upload files to, which has to be added to the CSP.'
+      },
+      remote_storage_download_host: {
+        format: :string,
+        default: nil,
+        writable: false,
+        description: 'Host the frontend uses to download files, which has to be added to the CSP.'
+      },
       report_incoming_email_errors: {
         description: 'Respond to incoming mails with error details',
         default: true

config/environments/production.rb

@@ -78,9 +78,9 @@
   # Allow disabling HSTS redirect by using OPENPROJECT_HSTS=false
   config.force_ssl = OpenProject::Configuration.https?
   config.ssl_options = {
+    hsts: OpenProject::Configuration.hsts_enabled?,
     # Disable redirect on the internal SYS API
     redirect: {
-      hsts: OpenProject::Configuration.hsts_enabled?,
       exclude: ->(request) do
         # Disable redirects when hsts is disabled
         return true unless OpenProject::Configuration.hsts_enabled?

config/initializers/export_formats.rb

@@ -1,10 +1,10 @@
 OpenProject::Application.configure do |application|
   application.config.to_prepare do
-    ::Exports::Register.register do
+    Exports::Register.register do
       list WorkPackage, WorkPackage::Exports::CSV
-      list WorkPackage, ::WorkPackage::PDFExport::WorkPackageListToPdf
+      list WorkPackage, WorkPackage::PDFExport::WorkPackageListToPdf
 
-      single WorkPackage, ::WorkPackage::PDFExport::WorkPackageToPdf
+      single WorkPackage, WorkPackage::PDFExport::WorkPackageToPdf
 
       formatter WorkPackage, WorkPackage::Exports::Formatters::Costs
       formatter WorkPackage, WorkPackage::Exports::Formatters::EstimatedHours
@@ -13,6 +13,7 @@
       list Project, Projects::Exports::CSV
       formatter Project, Exports::Formatters::CustomField
       formatter Project, Projects::Exports::Formatters::Status
+      formatter Project, Projects::Exports::Formatters::Description
     end
   end
 end