From 0b35f6bc8b8e08ae3b7c8547e8deeebba6d2bc3e Mon Sep 17 00:00:00 2001 From: Nick May Date: Sat, 5 Nov 2022 14:48:10 +1100 Subject: [PATCH 01/16] Security Updates (#62) From 24b235f1a07b1dfd48f95fd88df9f48ed2ffac44 Mon Sep 17 00:00:00 2001 From: DReSA Support <91715679+dresa-org-au@users.noreply.github.com> Date: Sat, 28 Jan 2023 15:45:11 +1100 Subject: [PATCH 02/16] Version 1.4.3 (#69) * Bump Sidekiq version. * Added more information text to html * Added #373 and #374 * Updates to packages, content_providers, and trainers. * Updated all models. * Updated event and material search and filter options. * Fix trainer filters. * Fixed language filter as label. * Updated change log. * Removed start and end from filters. * Added Security Updates 5 to change log. * Update rack and globalid. * Update version number and repository name. --------- Co-authored-by: eResEngineer Co-authored-by: Nick May --- CHANGE_LOG.md | 3 ++- Gemfile | 15 +++++++++++---- Gemfile.lock | 28 +++++++++++++++------------- app/models/event.rb | 4 ++-- config/initializers/version.rb | 2 +- config/tess.example.yml | 2 +- 6 files changed, 32 insertions(+), 22 deletions(-) diff --git a/CHANGE_LOG.md b/CHANGE_LOG.md index 6401770c4..8f7e65d8d 100644 --- a/CHANGE_LOG.md +++ b/CHANGE_LOG.md @@ -6,10 +6,11 @@ Deployed: *TBA* - Updates: - [Invite Email: Add Getting Started Information](https://github.com/nrmay/issues/374) - + - [Optimize Search Fields](https://github.com/nrmay/TeSS/issues/321) - Fixes: - [Security Updates 4](https://github.com/nrmay/TeSS/issues/373) + - [Security Updates 5](https://github.com/nrmay/TeSS/issues/385) ## [Version 1.4.2](https://github.com/dresa-org-au/TeSS/releases/tag/v1.4.2) diff --git a/Gemfile b/Gemfile index 46d44af67..53e43cddc 100644 --- a/Gemfile +++ b/Gemfile @@ -54,7 +54,7 @@ gem 'dynamic_sitemaps', github: 'lassebunk/dynamic_sitemaps', branch: 'master' gem 'whenever', '~> 1.0.0' # These are required for Sidekiq, to look up scientific topics -gem 'httparty' +gem 'httparty', '~> 0.21.0' gem 'sidekiq', '~> 6.5.6' gem 'slim' @@ -109,7 +109,7 @@ gem 'icalendar', '~> 2.4.1' gem 'bootstrap-datepicker-rails', '~> 1.6.4.1' -gem 'rack', '~> 2.2.3.1' +gem 'rack', '~> 2.2.6.2' gem 'rack-cors', require: 'rack/cors' @@ -148,7 +148,7 @@ gem 'rest-client' # for converting html to markdown gem 'reverse_markdown' -gem 'nokogiri', '~> 1.13.6' +gem 'nokogiri', '~> 1.13.10' # eventbrite api gem 'eventbrite_sdk' @@ -160,7 +160,14 @@ gem 'sassc', '= 2.1.0' gem 'psych', '< 4' # rails html sanitizer security update -gem 'rails-html-sanitizer', '~> 1.4.3' +gem 'rails-html-sanitizer', '~> 1.4.4' +gem 'loofah', '~> 2.19.1' + +# fix net-protocol warnings by specifically importing net-http +gem 'net-http' + +# security update 5 +gem 'globalid', '~> 1.0.1' source 'https://rails-assets.org' do gem 'rails-assets-clipboard', '~> 1.5.12' diff --git a/Gemfile.lock b/Gemfile.lock index 5043d9565..be06b5f4c 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -164,7 +164,7 @@ GEM friendly_id (5.2.5) activerecord (>= 4.0.0) geocoder (1.8.0) - globalid (1.0.0) + globalid (1.0.1) activesupport (>= 5.0) gravtastic (3.2.6) haml (5.0.4) @@ -181,8 +181,8 @@ GEM http-accept (1.7.0) http-cookie (1.0.5) domain_name (~> 0.5) - httparty (0.20.0) - mime-types (~> 3.0) + httparty (0.21.0) + mini_mime (>= 1.0.0) multi_xml (>= 0.5.2) httpclient (2.8.3) i18n (1.12.0) @@ -277,7 +277,7 @@ GEM listen (3.7.1) rb-fsevent (~> 0.10, >= 0.10.3) rb-inotify (~> 0.9, >= 0.9.10) - loofah (2.18.0) + loofah (2.19.1) crass (~> 1.0.2) nokogiri (>= 1.5.9) lunchy (0.10.4) @@ -317,7 +317,7 @@ GEM timeout netrc (0.11.0) nio4r (2.5.8) - nokogiri (1.13.8-x86_64-linux) + nokogiri (1.13.10-x86_64-linux) racc (~> 1.4) nokogumbo (2.0.5) nokogiri (~> 1.8, >= 1.8.4) @@ -358,8 +358,8 @@ GEM public_suffix (5.0.0) pundit (1.1.0) activesupport (>= 3.0.0) - racc (1.6.0) - rack (2.2.3.1) + racc (1.6.2) + rack (2.2.6.2) rack-cors (1.1.1) rack (>= 2.0.0) rack-oauth2 (1.21.2) @@ -395,8 +395,8 @@ GEM rails-dom-testing (2.0.3) activesupport (>= 4.2.0) nokogiri (>= 1.6) - rails-html-sanitizer (1.4.3) - loofah (~> 2.3) + rails-html-sanitizer (1.4.4) + loofah (~> 2.19, >= 2.19.1) rails-i18n (5.1.3) i18n (>= 0.7, < 2) railties (>= 5.0, < 6) @@ -674,10 +674,11 @@ DEPENDENCIES font-awesome-sass (~> 4.7.0) friendly_id (~> 5.2.4) geocoder + globalid (~> 1.0.1) gravtastic (~> 3.2.6) haml (~> 5.0.4) handlebars_assets - httparty + httparty (~> 0.21.0) i18n_data icalendar (~> 2.4.1) iso_country_codes @@ -690,10 +691,11 @@ DEPENDENCIES kt-paperclip (~> 6.4, >= 6.4.1) linkeddata listen + loofah (~> 2.19.1) lunchy minitest (= 5.10.3) money-rails - nokogiri (~> 1.13.6) + nokogiri (~> 1.13.10) omniauth-rails_csrf_protection omniauth_openid_connect pg @@ -702,7 +704,7 @@ DEPENDENCIES psych (< 4) public_activity (~> 1.6.4)! pundit (~> 1.1.0) - rack (~> 2.2.3.1) + rack (~> 2.2.6.2) rack-cors rails (~> 5.2.8.1) rails-assets-clipboard (~> 1.5.12)! @@ -711,7 +713,7 @@ DEPENDENCIES rails-assets-markdown-it (~> 7.0.1)! rails-assets-moment (~> 2.15.0)! rails-controller-testing - rails-html-sanitizer (~> 1.4.3) + rails-html-sanitizer (~> 1.4.4) rails-i18n rails_admin rdoc (>= 6.3.1) diff --git a/app/models/event.rb b/app/models/event.rb index baaf768da..2795b5e61 100644 --- a/app/models/event.rb +++ b/app/models/event.rb @@ -131,8 +131,8 @@ class Event < ApplicationRecord # :target_audience, :venue) def self.facet_fields - field_list = %w( city country content_provider cost_basis eligibility end - event_types fields keywords online organizer start + field_list = %w( city country content_provider cost_basis eligibility + event_types fields keywords online organizer target_audience venue ) field_list.append('operations') unless TeSS::Config.feature['disabled'].include? 'operations' field_list.append('scientific_topics') unless TeSS::Config.feature['disabled'].include? 'topics' diff --git a/config/initializers/version.rb b/config/initializers/version.rb index 69d971f5d..4e60c160a 100644 --- a/config/initializers/version.rb +++ b/config/initializers/version.rb @@ -1 +1 @@ -APP_VERSION = '1.4.2' +APP_VERSION = '1.4.3' diff --git a/config/tess.example.yml b/config/tess.example.yml index 4123827dd..3e213f65e 100644 --- a/config/tess.example.yml +++ b/config/tess.example.yml @@ -97,7 +97,7 @@ dresa: &dresa logo_open_graph: 'dresa/DReSA_Symbol.png' logo_email: 'dresa/DReSA_Extended_Default.png' theme: 'en-AU' - repository: 'https://github.com/nrmay/TeSS' + repository: 'https://github.com/dresa-org-au/TeSS' supported_by: 'dresa_supported_by.erb' widget_example: 'elixir_widget_example' gmaps: From b67f4c399b9e1abb2d3fb12f2e57b2e280278c57 Mon Sep 17 00:00:00 2001 From: DReSA Support <91715679+dresa-org-au@users.noreply.github.com> Date: Sat, 28 Jan 2023 16:06:55 +1100 Subject: [PATCH 03/16] 374 invite email (#70) * Bump Sidekiq version. * Added more information text to html --------- Co-authored-by: eResEngineer Co-authored-by: Nick May From d77ac7737306173cae26e102fbf5a445196c011c Mon Sep 17 00:00:00 2001 From: DReSA Support <91715679+dresa-org-au@users.noreply.github.com> Date: Sat, 28 Jan 2023 16:37:04 +1100 Subject: [PATCH 04/16] Merge nmay/master (#71) Co-authored-by: Nick May From 22eebeba550b715b5dbac835dd42d5ee9bc710c1 Mon Sep 17 00:00:00 2001 From: DReSA Support <91715679+dresa-org-au@users.noreply.github.com> Date: Sun, 29 Jan 2023 11:48:10 +1100 Subject: [PATCH 05/16] Update CHANGE_LOG.md (#72) Set v1.4.3 tag and deployment date. --- CHANGE_LOG.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CHANGE_LOG.md b/CHANGE_LOG.md index 8f7e65d8d..8c8e86e17 100644 --- a/CHANGE_LOG.md +++ b/CHANGE_LOG.md @@ -1,8 +1,8 @@ # Version Change Log The sections below refer to the release tags for this repository: -## [Version 1.4.3](https://github.com/dresa-org-au/TeSS/releases/tag/v1.4.2) +## [Version 1.4.3](https://github.com/dresa-org-au/TeSS/releases/tag/v1.4.3) -Deployed: *TBA* +Deployed: *28th January, 2023* - Updates: - [Invite Email: Add Getting Started Information](https://github.com/nrmay/issues/374) From 7414be654fb7203b243c582a106781cd90e93513 Mon Sep 17 00:00:00 2001 From: DReSA Support <91715679+dresa-org-au@users.noreply.github.com> Date: Mon, 14 Aug 2023 15:08:17 +1000 Subject: [PATCH 06/16] Test (#73) * test * . * . * . * Update activities_controller.rb * Update application_controller.rb * Update application_controller.rb * Update application_controller.rb * Update application_controller.rb * Update users_controller.rb * Update production.rb * Update production.rb * git add bin files * Update show.html.erb * update user show view --------- Co-authored-by: Nick May Co-authored-by: Tom --- CHANGE_LOG.md | 3 ++- Gemfile.lock | 6 +++++- app/assets/images/markdown_logo.png | Bin app/assets/images/markdown_logo.png.orig | Bin 0 -> 683 bytes app/views/search/common/_search_info.html.erb | 2 +- app/views/users/show.html.erb | 6 +++--- bin/bundle | 0 bin/rails | 0 bin/rake | 0 bin/setup | 0 bin/spring | 0 bin/update | 0 bin/yarn | 0 db/schema.rb | 10 +++++----- 14 files changed, 16 insertions(+), 11 deletions(-) mode change 100755 => 100644 app/assets/images/markdown_logo.png create mode 100644 app/assets/images/markdown_logo.png.orig mode change 100755 => 100644 bin/bundle mode change 100755 => 100644 bin/rails mode change 100755 => 100644 bin/rake mode change 100755 => 100644 bin/setup mode change 100755 => 100644 bin/spring mode change 100755 => 100644 bin/update mode change 100755 => 100644 bin/yarn diff --git a/CHANGE_LOG.md b/CHANGE_LOG.md index 8c8e86e17..61c49d712 100644 --- a/CHANGE_LOG.md +++ b/CHANGE_LOG.md @@ -1,6 +1,7 @@ # Version Change Log The sections below refer to the release tags for this repository: -## [Version 1.4.3](https://github.com/dresa-org-au/TeSS/releases/tag/v1.4.3) +<<<<<<< HEAD +## [Version 1.4.3](https://github.com/dresa-org-au/TeSS/releases/tag/v1.4.2) Deployed: *28th January, 2023* diff --git a/Gemfile.lock b/Gemfile.lock index be06b5f4c..517804fb5 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -307,6 +307,8 @@ GEM multi_json (1.15.0) multi_xml (0.6.0) nested_form (0.3.2) + net-http (0.3.2) + uri net-http-persistent (4.0.1) connection_pool (~> 2.2) net-protocol (0.1.3) @@ -626,6 +628,7 @@ GEM unicorn (6.1.0) kgio (~> 2.6) raindrops (~> 0.7) + uri (0.12.0) validate_email (0.1.6) activemodel (>= 3.0) mail (>= 2.2.5) @@ -695,6 +698,7 @@ DEPENDENCIES lunchy minitest (= 5.10.3) money-rails + net-http nokogiri (~> 1.13.10) omniauth-rails_csrf_protection omniauth_openid_connect @@ -747,4 +751,4 @@ DEPENDENCIES will_paginate BUNDLED WITH - 2.3.21 + 2.3.14 diff --git a/app/assets/images/markdown_logo.png b/app/assets/images/markdown_logo.png old mode 100755 new mode 100644 diff --git a/app/assets/images/markdown_logo.png.orig b/app/assets/images/markdown_logo.png.orig new file mode 100644 index 0000000000000000000000000000000000000000..0dd62aff6482478fffecba087756dd8ad21852b6 GIT binary patch literal 683 zcmV;c0#yBpP)WFU8GbZ8()Nlj2>E@cM*00Iw5L_t(&-tC${NW(xF z#ebwMLB|FMH)l~gh)#|w&RTFOZcc)WXu(AU7iYoI#i5EIE?PSZ;-o?c zwQ=Z`o*`-eT>scyKKN*w`>xmblDxdj1!}PcJOX9FifERBCxP`(=ePW7 z(V|QLl8Pc)k}^6)J$Jb3bDRYaW8#;9v`hcDu$WZ|uz+cg0VjMov$hb>C=Iv*23^|v zfO{Q8u;8-)L6^HgKX75&cMJ@7f-O|l06DXw&sxCQSz9!qy9tDD13kc|&PJ#sz&C<` zxq$WQs1fiAtoW?W0(TAg&p-c31WnO?>LGBKqHZ*x2)>~H=xe;0PSBKUZe41grJA4w z0DLNdpJ}!gHf?q9w)SruurLJlh6KOVN-JEAG28bk4`Tg92}lO)lLby%sR44#i?(%# zwlHTvH70!?`LkBe22Gdxl*@h<0sv+`z+bm|I&20!HB|{fT-#3li|u$G&<+9sHWcOo zksttINA&v$Vdz2;;FPI=1CLN!q?9uZ0RX$=HW}Ld88+a$tqjGF#bW|u0@ST)M{7aC zW*`nV0DUBF7oqZoh^1*}s!ZHy2>u2t?+5`L2oI111|sYS%2eKj+o!U~$}dGQjx;#K RT$}&^002ovPDHLkV1oS)4~PH& literal 0 HcmV?d00001 diff --git a/app/views/search/common/_search_info.html.erb b/app/views/search/common/_search_info.html.erb index 5dc0c9750..5a313681b 100644 --- a/app/views/search/common/_search_info.html.erb +++ b/app/views/search/common/_search_info.html.erb @@ -10,5 +10,5 @@ resource_type - type of result objects returned by SOLR, may or may not be passe <% local_assigns.fetch :resource_type, 'result' %> <%# RESULTS COUNT %>
- <%= pluralize( resources.total, resource_type.humanize.downcase ) %> found + <%=resources.total.to_s%> <%=resource_type.humanize.downcase.pluralize(resources.total)%> found
diff --git a/app/views/users/show.html.erb b/app/views/users/show.html.erb index fab2b21b3..e0c4c39e8 100644 --- a/app/views/users/show.html.erb +++ b/app/views/users/show.html.erb @@ -185,8 +185,8 @@
- <%= (upcoming_events.count > 0 ? "Showing" : "Found") + " #{pluralize(events.count, "upcoming event")}#{(upcoming_events.count > resource_limit) ? " out of #{upcoming_events.count}" : ''}." %> - <%= "Found #{pluralize(past_events.count, "past event")}." %> + <%= (upcoming_events.count > 0 ? "Showing" : "Found") + events.count.to_s + " #{"upcoming event".pluralize(events.count)}#{(upcoming_events.count > resource_limit) ? " out of #{upcoming_events.count}" : ''}." %> + <%= "Found “ + past_events.count.to_s + #{"past event".pluralize(past_events.count)}." %>
    <% if upcoming_events.count > resource_limit %> @@ -227,7 +227,7 @@
    - <%= (packages.count > 0 ? "Showing" : "Found") + " #{pluralize(packages.count, "package")}#{(@user.packages.count > resource_limit) ? " out of #{@user.packages.count}" : ''}." %> + <%= (packages.count > 0 ? "Showing" : "Found") + " " + packages.count.to_s + " #{"package".pluralize(packages.count)}#{(@user.packages.count > resource_limit) ? " out of #{@user.packages.count}" : ''}." %> <%= link_to('View all results.', packages(user: @user.username)) if (@user.packages.count > resource_limit) %>
    <% packages.each do |package| %> diff --git a/bin/bundle b/bin/bundle old mode 100755 new mode 100644 diff --git a/bin/rails b/bin/rails old mode 100755 new mode 100644 diff --git a/bin/rake b/bin/rake old mode 100755 new mode 100644 diff --git a/bin/setup b/bin/setup old mode 100755 new mode 100644 diff --git a/bin/spring b/bin/spring old mode 100755 new mode 100644 diff --git a/bin/update b/bin/update old mode 100755 new mode 100644 diff --git a/bin/yarn b/bin/yarn old mode 100755 new mode 100644 diff --git a/db/schema.rb b/db/schema.rb index 226cada28..40fc4fb67 100644 --- a/db/schema.rb +++ b/db/schema.rb @@ -318,13 +318,13 @@ t.string "slug" t.boolean "public", default: false t.text "description" - t.string "expertise_academic", default: [], array: true - t.string "expertise_technical", default: [], array: true t.text "location" t.string "orcid" t.string "experience" - t.text "interest", default: [], array: true - t.text "activity", default: [], array: true + t.string "expertise_academic", default: [], array: true + t.string "expertise_technical", default: [], array: true + t.string "interest", default: [], array: true + t.string "activity", default: [], array: true t.string "language", default: [], array: true t.string "social_media", default: [], array: true t.string "type", default: "Profile" @@ -443,7 +443,7 @@ t.integer "invitations_count", default: 0 t.index ["authentication_token"], name: "index_users_on_authentication_token" t.index ["confirmation_token"], name: "index_users_on_confirmation_token", unique: true - t.index ["email"], name: "index_users_on_email", unique: true + t.index ["email"], name: "index_users_on_email" t.index ["identity_url"], name: "index_users_on_identity_url", unique: true t.index ["invitation_token"], name: "index_users_on_invitation_token", unique: true t.index ["invited_by_id"], name: "index_users_on_invited_by_id" From 243ab1b75d524869801a84a4532ce01bd0e3753a Mon Sep 17 00:00:00 2001 From: root Date: Thu, 31 Aug 2023 23:41:52 +0000 Subject: [PATCH 07/16] fix show bugs --- app/views/users/show.html.erb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/app/views/users/show.html.erb b/app/views/users/show.html.erb index e0c4c39e8..3ae518a2e 100644 --- a/app/views/users/show.html.erb +++ b/app/views/users/show.html.erb @@ -185,8 +185,8 @@
    - <%= (upcoming_events.count > 0 ? "Showing" : "Found") + events.count.to_s + " #{"upcoming event".pluralize(events.count)}#{(upcoming_events.count > resource_limit) ? " out of #{upcoming_events.count}" : ''}." %> - <%= "Found “ + past_events.count.to_s + #{"past event".pluralize(past_events.count)}." %> + <%= (upcoming_events.count > 0 ? "Showing" : "Found") + " " + events.count.to_s + " #{"upcoming event".pluralize(events.count)}#{(upcoming_events.count > resource_limit) ? " out of #{upcoming_events.count}" : ''}." %> + <%= "Found " + past_events.count.to_s + " #{"past event".pluralize(past_events.count)}." %>
      <% if upcoming_events.count > resource_limit %> @@ -212,7 +212,7 @@
      - <%= (materials.count > 0 ? "Showing" : "Found") + " #{pluralize(materials.count, "material")}#{(@user.materials.count > resource_limit) ? " out of #{@user.materials.count}" : ''}." %> + <%= (materials.count > 0 ? "Showing" : "Found") + " " + materials.count.to_s + " #{"material".pluralize(materials.count)}#{(@user.materials.count > resource_limit) ? " out of #{@user.materials.count}" : ''}." %> <%= link_to('View all results.', materials_path(user: @user.username)) if (@user.materials.count > resource_limit) %>
      <% materials.each do |material| %> From df118740731930486a15fc29a36f84cdc19d7414 Mon Sep 17 00:00:00 2001 From: DReSA Support <91715679+dresa-org-au@users.noreply.github.com> Date: Fri, 1 Sep 2023 10:21:10 +1000 Subject: [PATCH 08/16] Test (#74) * Update activities_controller.rb * Update application_controller.rb * Update application_controller.rb * Update application_controller.rb * Update application_controller.rb * Update users_controller.rb * Update production.rb * Update production.rb * git add bin files * Update show.html.erb * update user show view * upload gemfile uri version * Update Gemfile.lock URI version --------- Fix incorrect pluralization/ update a few packages Co-authored-by: Nick May Co-authored-by: Tom --- Gemfile.lock | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Gemfile.lock b/Gemfile.lock index 517804fb5..40a1655e0 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -628,7 +628,7 @@ GEM unicorn (6.1.0) kgio (~> 2.6) raindrops (~> 0.7) - uri (0.12.0) + uri (0.12.2) validate_email (0.1.6) activemodel (>= 3.0) mail (>= 2.2.5) From 510d0337f208ead6811f5f59ac0d7b06b5dfd8d7 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 7 Feb 2024 03:53:25 +0000 Subject: [PATCH 09/16] . --- app/views/layouts/_dresa_funded_by.erb | 25 +++++++-------------- app/views/layouts/_dresa_funded_by_text.erb | 13 +++++++++++ app/views/layouts/_dresa_supported_by.erb | 7 +----- app/views/layouts/_footer.html.erb | 10 +++++++-- config/dictionaries/licences.yml | 20 +++++++++++++---- config/dictionaries/licences_dresa.yml | 16 +++++++++++-- config/environments/development.rb | 3 ++- config/environments/production.rb | 2 +- lib/ingestors/ingestor_material_rest.rb | 2 +- 9 files changed, 64 insertions(+), 34 deletions(-) create mode 100644 app/views/layouts/_dresa_funded_by_text.erb diff --git a/app/views/layouts/_dresa_funded_by.erb b/app/views/layouts/_dresa_funded_by.erb index 0b94e1d4a..3fd98f431 100644 --- a/app/views/layouts/_dresa_funded_by.erb +++ b/app/views/layouts/_dresa_funded_by.erb @@ -1,25 +1,16 @@ - -