diff --git a/CHANGE_LOG.md b/CHANGE_LOG.md index 6401770c4..61c49d712 100644 --- a/CHANGE_LOG.md +++ b/CHANGE_LOG.md @@ -1,15 +1,17 @@ # Version Change Log The sections below refer to the release tags for this repository: +<<<<<<< HEAD ## [Version 1.4.3](https://github.com/dresa-org-au/TeSS/releases/tag/v1.4.2) -Deployed: *TBA* +Deployed: *28th January, 2023* - Updates: - [Invite Email: Add Getting Started Information](https://github.com/nrmay/issues/374) - + - [Optimize Search Fields](https://github.com/nrmay/TeSS/issues/321) - Fixes: - [Security Updates 4](https://github.com/nrmay/TeSS/issues/373) + - [Security Updates 5](https://github.com/nrmay/TeSS/issues/385) ## [Version 1.4.2](https://github.com/dresa-org-au/TeSS/releases/tag/v1.4.2) diff --git a/Gemfile b/Gemfile index 46d44af67..53e43cddc 100644 --- a/Gemfile +++ b/Gemfile @@ -54,7 +54,7 @@ gem 'dynamic_sitemaps', github: 'lassebunk/dynamic_sitemaps', branch: 'master' gem 'whenever', '~> 1.0.0' # These are required for Sidekiq, to look up scientific topics -gem 'httparty' +gem 'httparty', '~> 0.21.0' gem 'sidekiq', '~> 6.5.6' gem 'slim' @@ -109,7 +109,7 @@ gem 'icalendar', '~> 2.4.1' gem 'bootstrap-datepicker-rails', '~> 1.6.4.1' -gem 'rack', '~> 2.2.3.1' +gem 'rack', '~> 2.2.6.2' gem 'rack-cors', require: 'rack/cors' @@ -148,7 +148,7 @@ gem 'rest-client' # for converting html to markdown gem 'reverse_markdown' -gem 'nokogiri', '~> 1.13.6' +gem 'nokogiri', '~> 1.13.10' # eventbrite api gem 'eventbrite_sdk' @@ -160,7 +160,14 @@ gem 'sassc', '= 2.1.0' gem 'psych', '< 4' # rails html sanitizer security update -gem 'rails-html-sanitizer', '~> 1.4.3' +gem 'rails-html-sanitizer', '~> 1.4.4' +gem 'loofah', '~> 2.19.1' + +# fix net-protocol warnings by specifically importing net-http +gem 'net-http' + +# security update 5 +gem 'globalid', '~> 1.0.1' source 'https://rails-assets.org' do gem 'rails-assets-clipboard', '~> 1.5.12' diff --git a/Gemfile.lock b/Gemfile.lock index 5043d9565..40a1655e0 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -164,7 +164,7 @@ GEM friendly_id (5.2.5) activerecord (>= 4.0.0) geocoder (1.8.0) - globalid (1.0.0) + globalid (1.0.1) activesupport (>= 5.0) gravtastic (3.2.6) haml (5.0.4) @@ -181,8 +181,8 @@ GEM http-accept (1.7.0) http-cookie (1.0.5) domain_name (~> 0.5) - httparty (0.20.0) - mime-types (~> 3.0) + httparty (0.21.0) + mini_mime (>= 1.0.0) multi_xml (>= 0.5.2) httpclient (2.8.3) i18n (1.12.0) @@ -277,7 +277,7 @@ GEM listen (3.7.1) rb-fsevent (~> 0.10, >= 0.10.3) rb-inotify (~> 0.9, >= 0.9.10) - loofah (2.18.0) + loofah (2.19.1) crass (~> 1.0.2) nokogiri (>= 1.5.9) lunchy (0.10.4) @@ -307,6 +307,8 @@ GEM multi_json (1.15.0) multi_xml (0.6.0) nested_form (0.3.2) + net-http (0.3.2) + uri net-http-persistent (4.0.1) connection_pool (~> 2.2) net-protocol (0.1.3) @@ -317,7 +319,7 @@ GEM timeout netrc (0.11.0) nio4r (2.5.8) - nokogiri (1.13.8-x86_64-linux) + nokogiri (1.13.10-x86_64-linux) racc (~> 1.4) nokogumbo (2.0.5) nokogiri (~> 1.8, >= 1.8.4) @@ -358,8 +360,8 @@ GEM public_suffix (5.0.0) pundit (1.1.0) activesupport (>= 3.0.0) - racc (1.6.0) - rack (2.2.3.1) + racc (1.6.2) + rack (2.2.6.2) rack-cors (1.1.1) rack (>= 2.0.0) rack-oauth2 (1.21.2) @@ -395,8 +397,8 @@ GEM rails-dom-testing (2.0.3) activesupport (>= 4.2.0) nokogiri (>= 1.6) - rails-html-sanitizer (1.4.3) - loofah (~> 2.3) + rails-html-sanitizer (1.4.4) + loofah (~> 2.19, >= 2.19.1) rails-i18n (5.1.3) i18n (>= 0.7, < 2) railties (>= 5.0, < 6) @@ -626,6 +628,7 @@ GEM unicorn (6.1.0) kgio (~> 2.6) raindrops (~> 0.7) + uri (0.12.2) validate_email (0.1.6) activemodel (>= 3.0) mail (>= 2.2.5) @@ -674,10 +677,11 @@ DEPENDENCIES font-awesome-sass (~> 4.7.0) friendly_id (~> 5.2.4) geocoder + globalid (~> 1.0.1) gravtastic (~> 3.2.6) haml (~> 5.0.4) handlebars_assets - httparty + httparty (~> 0.21.0) i18n_data icalendar (~> 2.4.1) iso_country_codes @@ -690,10 +694,12 @@ DEPENDENCIES kt-paperclip (~> 6.4, >= 6.4.1) linkeddata listen + loofah (~> 2.19.1) lunchy minitest (= 5.10.3) money-rails - nokogiri (~> 1.13.6) + net-http + nokogiri (~> 1.13.10) omniauth-rails_csrf_protection omniauth_openid_connect pg @@ -702,7 +708,7 @@ DEPENDENCIES psych (< 4) public_activity (~> 1.6.4)! pundit (~> 1.1.0) - rack (~> 2.2.3.1) + rack (~> 2.2.6.2) rack-cors rails (~> 5.2.8.1) rails-assets-clipboard (~> 1.5.12)! @@ -711,7 +717,7 @@ DEPENDENCIES rails-assets-markdown-it (~> 7.0.1)! rails-assets-moment (~> 2.15.0)! rails-controller-testing - rails-html-sanitizer (~> 1.4.3) + rails-html-sanitizer (~> 1.4.4) rails-i18n rails_admin rdoc (>= 6.3.1) @@ -745,4 +751,4 @@ DEPENDENCIES will_paginate BUNDLED WITH - 2.3.21 + 2.3.14 diff --git a/app/assets/images/markdown_logo.png b/app/assets/images/markdown_logo.png old mode 100755 new mode 100644 diff --git a/app/assets/images/markdown_logo.png.orig b/app/assets/images/markdown_logo.png.orig new file mode 100644 index 000000000..0dd62aff6 Binary files /dev/null and b/app/assets/images/markdown_logo.png.orig differ diff --git a/app/models/event.rb b/app/models/event.rb index baaf768da..2795b5e61 100644 --- a/app/models/event.rb +++ b/app/models/event.rb @@ -131,8 +131,8 @@ class Event < ApplicationRecord # :target_audience, :venue) def self.facet_fields - field_list = %w( city country content_provider cost_basis eligibility end - event_types fields keywords online organizer start + field_list = %w( city country content_provider cost_basis eligibility + event_types fields keywords online organizer target_audience venue ) field_list.append('operations') unless TeSS::Config.feature['disabled'].include? 'operations' field_list.append('scientific_topics') unless TeSS::Config.feature['disabled'].include? 'topics' diff --git a/app/views/search/common/_search_info.html.erb b/app/views/search/common/_search_info.html.erb index 5dc0c9750..5a313681b 100644 --- a/app/views/search/common/_search_info.html.erb +++ b/app/views/search/common/_search_info.html.erb @@ -10,5 +10,5 @@ resource_type - type of result objects returned by SOLR, may or may not be passe <% local_assigns.fetch :resource_type, 'result' %> <%# RESULTS COUNT %>