Backport 5.2.7 changes to 6.0

.github/prompts/write-test.prompt.md

@@ -0,0 +1,32 @@
+---
+mode: 'agent'
+tools: ['testFailure', 'usages']
+description: 'Generate a functional test for highlighted code'
+---
+Generate a new or update an existing functional test for the highlighted code. The test should cover the following aspects:
+
+A good test should be:
+- **Isolated**: It should not depend on other tests or external systems.
+- **Fast**: It should run quickly to allow for rapid feedback during development.
+- **Deterministic**: It should produce the same result every time it runs, regardless of the environment.
+- **Readable**: It should be easy to understand and maintain.
+- **Descriptive**: It should clearly indicate what it is testing and why.
+- **Comprehensive**: It should cover a wide range of scenarios, including edge cases.
+- **Independent**: It should not rely on the state of the application or database, ensuring that it can run in any order without affecting other tests.
+- **Behavior-focused**: It should test output for specific input rather than internal implementation, except when verifying performance-critical operations like expensive method calls.
+
+Good practices:
+- Never mock objects that have no PHP service dependencies like event or entity classes. Use the real object instead.
+- The best way to write a functional test is to use the actual endpoint. Either call a route or a command. The next best thing is to call a subscriber via EventDispatcher. If that is still too broad call a service.
+- Make all new classes final by default. Including tests.
+- Provide property, param and return types. If not possible to use native types you can always specify the types in the docblock. Mautic uses PHPSTAN so be sure to add types so the PHPSTAN won't fail.
+- Use `$this->assertResponseIsSuccessful();` to assert successful requests.
+- Use PHPUNIT's data providers to test multiple scenarios in a single test method.
+
+Suggestions for AI:
+- Do not modify the production code unless requested. Always just modify the test code.
+- Make the simplest test possible. The human will suggest improvements if needed.
+
+You can take an inspiration of existing functional tests. They all extend the `MysqlFunctionalTestCase` class and are located in the `app/bundles/*Bundle/Tests` or `plugins/*Bundle/Tests` directory. The tests are written in PHPUNIT. You can read the version in the `composer.json` file.
+
+To execute a test you have to run it in DDEV. Example: `ddev exec composer test app/bundles/ExampleBundle/tests/ExampleTest.php`.

.github/workflows/transifex.yml

@@ -13,20 +13,22 @@ permissions:
 
 jobs:
   push-to-transifex:
-    if: github.repository == 'mautic/mautic'
+    # Run only in the 'mautic/mautic' repository and on the default branch (or manually triggered via UI)
+    if: github.repository == 'mautic/mautic' && (github.ref_name == github.event.repository.default_branch || github.event_name == 'workflow_dispatch')
     name: Push translations to Transifex
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - name: Checkout
+      uses: actions/checkout@v4
 
-    - name: Setup PHP, with composer and extensions
+    - name: Setup PHP with extensions
       uses: shivammathur/setup-php@v2
       with:
         php-version: 8.3
         extensions: mbstring, xml, ctype, iconv, intl, pdo_sqlite, mysql, pdo_mysql
 
-    - name: Install dependencies
+    - name: Install Composer dependencies
       uses: "ramsey/composer-install@v3"
 
     - name: Push translations to Transifex

.htaccess

@@ -99,6 +99,11 @@
 
 # Apache 2.4+
 <IfModule authz_core_module>
+    # Deny access via HTTP requests to all .env files.
+    <FilesMatch "^\.env.*$">
+        Require all denied
+    </FilesMatch>
+
     # Deny access via HTTP requests to all PHP files.
     <FilesMatch "\.php$">
         Require all denied
@@ -117,6 +122,12 @@
 
 # Fallback for Apache < 2.4
 <IfModule !authz_core_module>
+    # Deny access via HTTP requests to all .env files.
+    <FilesMatch "^\.env.*$">
+        Order deny,allow
+        Deny from all
+    </FilesMatch>
+
     # Deny access via HTTP requests to all PHP files.
     <FilesMatch "\.php$">
         Order deny,allow

app/assets/scaffold/files/htaccess

@@ -99,6 +99,11 @@
 
 # Apache 2.4+
 <IfModule authz_core_module>
+    # Deny access via HTTP requests to all .env files.
+    <FilesMatch "^\.env.*$">
+        Require all denied
+    </FilesMatch>
+
     # Deny access via HTTP requests to all PHP files.
     <FilesMatch "\.php$">
         Require all denied
@@ -117,6 +122,12 @@
 
 # Fallback for Apache < 2.4
 <IfModule !authz_core_module>
+    # Deny access via HTTP requests to all .env files.
+    <FilesMatch "^\.env.*$">
+        Order deny,allow
+        Deny from all
+    </FilesMatch>
+
     # Deny access via HTTP requests to all PHP files.
     <FilesMatch "\.php$">
         Order deny,allow

app/bundles/ApiBundle/Controller/CommonApiController.php

@@ -408,7 +408,18 @@ protected function processBatchForm(Request $request, $key, $entity, $params, $m
             $errors[$key] = $formResponse;
         }
 
-        $this->doctrine->getManager()->detach($entity);
+        $lastEntityIndex = -1;
+        foreach ($entities as $index => $moreEntities) {
+            if ($moreEntities !== $entity) {
+                continue;
+            }
+
+            $lastEntityIndex = $index;
+        }
+
+        if (-1 === $lastEntityIndex || $lastEntityIndex === $key) {
+            $this->doctrine->getManager()->detach($entity);
+        }
 
         $this->inBatchMode = false;
     }

app/bundles/AssetBundle/Entity/Asset.php

@@ -1231,11 +1231,17 @@ public static function validateFile($object, ExecutionContextInterface $context)
                     ->setTranslationDomain('validators')
                     ->addViolation();
             }
-            $loader           = new ParameterLoader();
-            $parameters       = $loader->getParameterBag();
-            $mimeTypesAllowed = $parameters->get('allowed_mimetypes');
+            $parameters        = (new ParameterLoader())->getParameterBag();
+            $extensionsAllowed = $parameters->get('allowed_extensions');
+            $mimeTypesMap      = $parameters->get('allowed_mimetypes');
+            $mimeTypesAllowed  = array_intersect_key($mimeTypesMap, array_flip($extensionsAllowed));
 
-            if (!empty($object->getFileMimeType()) && !in_array($object->getFileMimeType(), $mimeTypesAllowed)) {
+            $fileMimeType        = $object->getFileMimeType();
+            $fileExtension       = strtolower($object->getExtension() ?? '');
+            $lowercaseMimeTypes  = array_change_key_case($mimeTypesAllowed, CASE_LOWER);
+            $lowercaseMimeValues = array_map('strtolower', $mimeTypesAllowed);
+
+            if (!empty($fileMimeType) && array_key_exists($fileExtension, $lowercaseMimeTypes) && !in_array(strtolower($fileMimeType), $lowercaseMimeValues, true)) {
                 $context->buildViolation('mautic.asset.asset.error.invalid.mimetype', [
                     '%fileMimetype%'=> $object->getFileMimeType(),
                     '%mimetypes%'   => implode(', ', $mimeTypesAllowed),
@@ -1244,9 +1250,8 @@ public static function validateFile($object, ExecutionContextInterface $context)
                     ->addViolation();
             }
 
-            $extensionsAllowed = array_keys($mimeTypesAllowed);
-            $fileType          = $object->getExtension();
-            if (null !== $object->getExtension() && !in_array($fileType, $extensionsAllowed)) {
+            $fileType = $object->getExtension();
+            if (null !== $fileType && !in_array(strtolower($fileType), array_map('strtolower', $extensionsAllowed), true)) {
                 $context->buildViolation('mautic.asset.asset.error.file.extension', [
                     '%fileExtension%'=> $object->getExtension(),
                     '%extensions%'   => implode(', ', $extensionsAllowed),

app/bundles/AssetBundle/Entity/DownloadRepository.php

@@ -56,11 +56,13 @@ public function getLeadDownloads($leadId = null, array $options = [])
             ->leftJoin('d', MAUTIC_TABLE_PREFIX.'assets', 'a', 'd.asset_id = a.id');
 
         if ($leadId) {
-            $query->where('d.lead_id = '.(int) $leadId);
+            $query->where('d.lead_id = :leadId')
+                ->setParameter('leadId', $leadId);
         }
 
         if (isset($options['search']) && $options['search']) {
-            $query->andWhere($query->expr()->like('a.title', $query->expr()->literal('%'.$options['search'].'%')));
+            $query->andWhere('a.title LIKE :search')
+                  ->setParameter('search', '%'.$options['search'].'%');
         }
 
         return $this->getTimelineResults($query, $options, 'a.title', 'd.date_download', [], ['date_download'], null, 'd.id');

app/bundles/AssetBundle/EventListener/UploadSubscriber.php

@@ -60,10 +60,11 @@ public function onPostUpload(PostUploadEvent $event): void
      */
     public function onUploadValidation(ValidationEvent $event): void
     {
-        $file       = $event->getFile();
-        $mimetypes  = $this->coreParametersHelper->get('allowed_mimetypes');
-        $extensions = array_keys($mimetypes);
-        $maxSize    = $this->assetModel->getMaxUploadSize('B');
+        $file                = $event->getFile();
+        $extensions          = $this->coreParametersHelper->get('allowed_extensions');
+        $configuredMimeTypes = $this->coreParametersHelper->get('allowed_mimetypes');
+        $allowedMimeTypes    = array_intersect_key($configuredMimeTypes, array_flip($extensions));
+        $maxSize             = $this->assetModel->getMaxUploadSize('B');
 
         if (null === $file) {
             return;
@@ -81,10 +82,12 @@ public function onUploadValidation(ValidationEvent $event): void
             throw new ValidationException($e->getMessage());
         }
 
-        try {
-            $this->checkMimeType($file->getMimeType(), $mimetypes, 'mautic.asset.asset.error.file.mimetype');
-        } catch (FileInvalidException $e) {
-            throw new ValidationException($e->getMessage());
+        if (array_key_exists(strtolower($file->getExtension()), array_change_key_case($configuredMimeTypes, CASE_LOWER))) {
+            try {
+                $this->checkMimeType($file->getMimeType(), $allowedMimeTypes, 'mautic.asset.asset.error.file.mimetype');
+            } catch (FileInvalidException $e) {
+                throw new ValidationException($e->getMessage());
+            }
         }
     }
 

app/bundles/AssetBundle/Form/Type/AssetType.php

@@ -197,15 +197,14 @@ public function validateExtension($object, ExecutionContextInterface $context):
         if (empty($object)) {
             return;
         }
-        $parameters       = (new ParameterLoader())->getParameterBag();
-        $mimeTypesAllowed = $parameters->get('allowed_mimetypes');
-        $extensions       = array_keys($mimeTypesAllowed);
-        $fileName         = $object;
+        $parameters = (new ParameterLoader())->getParameterBag();
+        $extensions = $parameters->get('allowed_extensions');
+        $fileName   = $object;
         if (!is_string($object) && $object instanceof Asset) {
             $fileName = $object->getOriginalFileName();
         }
         $fileExtension    = pathinfo($fileName, PATHINFO_EXTENSION);
-        if (!in_array($fileExtension, $extensions, true)) {
+        if (!in_array(strtolower($fileExtension), array_map('strtolower', $extensions), true)) {
             $context->buildViolation('mautic.asset.asset.error.file.extension', [
                 '%fileExtension%'=> $fileExtension,
                 '%extensions%'   => implode(', ', $extensions),

app/bundles/CampaignBundle/Assets/css/campaign.css

@@ -420,3 +420,14 @@
 .campaign-event-stat-divider {
     padding: 0 4px;
 }
+
+
+/* Text overflow handling for campaign source widget */
+.list-campaign-source .campaign-event-name {
+    max-width: 300px;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    display: inline-block;
+    vertical-align: middle;
+    white-space: nowrap;
+}

app/bundles/CampaignBundle/Entity/LeadEventLogRepository.php

@@ -97,7 +97,8 @@ public function getLeadLogs($leadId = null, array $options = [])
                         ->setParameter('eventType', 'decision');
 
         if ($leadId) {
-            $query->where('ll.lead_id = '.(int) $leadId);
+            $query->where('ll.lead_id = :leadId')
+                ->setParameter('leadId', $leadId);
         }
 
         if (isset($options['scheduledState'])) {
@@ -123,12 +124,12 @@ public function getLeadLogs($leadId = null, array $options = [])
         if (isset($options['search']) && $options['search']) {
             $query->andWhere(
                 $query->expr()->or(
-                    $query->expr()->like('e.name', $query->expr()->literal('%'.$options['search'].'%')),
-                    $query->expr()->like('e.description', $query->expr()->literal('%'.$options['search'].'%')),
-                    $query->expr()->like('c.name', $query->expr()->literal('%'.$options['search'].'%')),
-                    $query->expr()->like('c.description', $query->expr()->literal('%'.$options['search'].'%'))
+                    $query->expr()->like('e.name', ':search'),
+                    $query->expr()->like('e.description', ':search'),
+                    $query->expr()->like('c.name', ':search'),
+                    $query->expr()->like('c.description', ':search')
                 )
-            );
+            )->setParameter('search', '%'.$options['search'].'%');
         }
 
         return $this->getTimelineResults($query, $options, 'e.name', 'll.date_triggered', ['metadata'], ['dateTriggered', 'triggerDate'], null, 'll.id');
@@ -365,30 +366,27 @@ public function getChartQuery($options): array
             ->join('ll', MAUTIC_TABLE_PREFIX.'campaign_events', 'e', 'e.id = ll.event_id');
 
         if (isset($options['channel'])) {
-            $query->andwhere("e.channel = '".$options['channel']."'");
+            $query->andWhere('e.channel = '.$query->expr()->literal($options['channel']));
         }
 
         if (isset($options['channelId'])) {
-            $query->andwhere('e.channel_id = '.(int) $options['channelId']);
+            $query->andWhere('e.channel_id = '.(int) $options['channelId']);
         }
 
         if (isset($options['type'])) {
-            $query->andwhere("e.type = '".$options['type']."'");
+            $query->andWhere('e.type = '.$query->expr()->literal($options['type']));
         }
 
         if (isset($options['logChannel'])) {
-            $query->andwhere("ll.channel = '".$options['logChannel']."'");
+            $query->andWhere('ll.channel = '.$query->expr()->literal($options['logChannel']));
         }
 
         if (isset($options['logChannelId'])) {
-            $query->andwhere('ll.channel_id = '.(int) $options['logChannelId']);
+            $query->andWhere('ll.channel_id = '.(int) $options['logChannelId']);
         }
 
-        if (!isset($options['is_scheduled'])) {
-            $query->andWhere($query->expr()->eq('ll.is_scheduled', 0));
-        } else {
-            $query->andWhere($query->expr()->eq('ll.is_scheduled', 1));
-        }
+        $isScheduled = isset($options['is_scheduled']) ? 1 : 0;
+        $query->andWhere('ll.is_scheduled = '.$isScheduled);
 
         return $chartQuery->fetchTimeData('('.$query.')', 'date_triggered');
     }

app/bundles/CampaignBundle/Resources/views/Source/_index.html.twig

@@ -11,7 +11,7 @@
 {% endif %}
 <div class="campaign-event-content">
     <div class="h5 fw-b mb-5 campaign-source-title">{{'mautic.campaign.form.lead_source'|trans}}</div>
-    <div><span class="campaign-event-name ellipsis"><i class="mr-xs campaign-event-icon {% if 'lists' == sourceType %}ri-pie-chart-line{% else %}ri-survey-line{% endif %}"></i>{{ names|default(null) }}</span></div>
+    <div><span class="campaign-event-name ellipsis" title="{{ names|default(null) }}"><i class="mr-xs campaign-event-icon {% if 'lists' == sourceType %}ri-pie-chart-line{% else %}ri-survey-line{% endif %}"></i>{{ names|default(null) }}</span></div>
 </div>
 
 {% if update is not defined or update is empty %}

app/bundles/CategoryBundle/Controller/CategoryController.php

@@ -218,7 +218,6 @@ public function newAction(Request $request, $bundle)
         $cancelled  = $valid  = false;
         $method     = $request->getMethod();
         $inForm     = $this->getInFormValue($request, $method);
-        $showSelect = $request->get('show_bundle_select', false);
 
         // not found
         if (!$this->security->isGranted($model->getPermissionBase($bundle).':create')) {
@@ -229,7 +228,7 @@ public function newAction(Request $request, $bundle)
             'objectAction' => 'new',
             'bundle'       => $bundle,
         ]);
-        $form = $model->createForm($entity, $this->formFactory, $action, ['bundle' => $bundle, 'show_bundle_select' => $showSelect]);
+        $form = $model->createForm($entity, $this->formFactory, $action, ['bundle' => $bundle, 'show_bundle_select' => 'category' === $bundle]);
         $form['inForm']->setData($inForm);
         // /Check for a submitted form and process it
         if (Request::METHOD_POST === $method) {

app/bundles/CategoryBundle/Tests/Controller/CategoryControllerFunctionalTest.php

@@ -85,7 +85,7 @@ public function testNewActionWithInForm(): void
         $crawler->addHtmlContent($html);
         $saveButton = $crawler->selectButton('category_form[buttons][save]');
         $form       = $saveButton->form();
-        $form['category_form[bundle]']->setValue('category');
+        $form['category_form[bundle]']->setValue('global');
         $form['category_form[title]']->setValue('Test');
         $form['category_form[isPublished]']->setValue('1');
         $form['category_form[inForm]']->setValue('1');
@@ -118,6 +118,26 @@ public function testEditLockCategory(): void
         $this->assertStringContainsString('is currently checked out by', $this->client->getResponse()->getContent());
     }
 
+    public function testTypeFieldPersistsAfterValidationFailure(): void
+    {
+        $crawler                = $this->client->request(Request::METHOD_GET, 's/categories/category/new');
+        $clientResponse         = json_decode($this->client->getResponse()->getContent(), true);
+        $html                   = $clientResponse['newContent'];
+        $crawler->addHtmlContent($html);
+        $saveButton = $crawler->selectButton('category_form[buttons][save]');
+        $form       = $saveButton->form();
+        $form['category_form[bundle]']->setValue('global');
+        $form['category_form[title]']->setValue('');
+        $form['category_form[isPublished]']->setValue('1');
+        $form['category_form[inForm]']->setValue('1');
+
+        $this->client->submit($form);
+        Assert::assertTrue($this->client->getResponse()->isOk());
+        $clientResponse = $this->client->getResponse();
+        $body           = json_decode($clientResponse->getContent(), true);
+        $this->assertNotEmpty($crawler->filter('select#category_form_bundle')->count(), 'The "Type" (bundle) field should remain visible after validation failure.');
+    }
+
     public function testDeleteUsedInStage(): void
     {
         $category = new Category();

app/bundles/ChannelBundle/Entity/MessageQueueRepository.php

@@ -103,13 +103,14 @@ public function getLeadTimelineEvents($leadId = null, array $options = [])
             mq.scheduled_date as scheduledDate, mq.last_attempt as lastAttempt, mq.date_sent as dateSent');
 
         if ($leadId) {
-            $query->where('mq.lead_id = '.(int) $leadId);
+            $query->where('mq.lead_id = :leadId')
+                ->setParameter('leadId', $leadId);
         }
 
         if (isset($options['search']) && $options['search']) {
-            $query->andWhere($query->expr()->or(
-                $query->expr()->like('mq.channel', $query->expr()->literal('%'.$options['search'].'%'))
-            ));
+            $query->andWhere(
+                $query->expr()->like('mq.channel', ':search')
+            )->setParameter('search', '%'.$options['search'].'%');
         }
 
         return $this->getTimelineResults($query, $options, 'mq.channel', 'mq.date_published', [], ['dateAdded'], null, 'mq.id');