merge into master from develop #3200

Limraj · 2025-10-17T13:54:09Z

No description provided.

- Fixed create Data Source in new UI; - Fixed update Meta Data Point in new UI;

- Fixed Legend report;

- revert Legend report;

- Fixed Legend report;

…_name_in_legend_report_for_escape_characters #3049 Fixed visible point name in legend report for escape characters:

#3050 XSS in Reports names

- Fixed EventList.vue;

…rected Common.java;

…event_XSS_for_REST_API_by_escape_String_content2 # Conflicts: # src/com/serotonin/mango/vo/report/SeriesIdentifier.java

- Using class XssProtectUtils (use Spring) instead of Security class from dwr; _ Rename classes: XssProtectHtmlUtils to XssProtectUtils, XssUtils to XssValidatorUtils; - Changed private on public no args constructor for class XssProtectUtils; - Added Data Point information to console log in ScriptExecutor.convertContext;

- Created css class formLongFieldSizing; - Added attribute title and css class formLongFieldSizing in pointProperties.jsp for name fields; - Set width 60%/40% in dataPointEdit.jsp; - Use c:out in pointProperties.jsp for name and description fields;

- Set max-width is 650px

- Fixed XSS Event List on new UI;

- Removed unuse import in PointProperties\index.vue; - Added @XssProtect annotation to fields deviceName, datasourceName, dataSourceXid in DataPointJson, to fields oid, binary0Value in SnmpPointLocatorJson, to fields updateCronPattern in MetaPointLocatorJson, to fields charset in ModbusIpPointLocatorJson;

- Reload the page;

…T_API_by_escape_String_content2 #2985 Prevent XSS for REST API by escape String content:

…oint_properties_page_has_a_limited_visible_length #3036 point name in point properties page has a limited visible length

- removed deprecated methods: DataPointService.save(User user, String value, String xid, int pointValueType); setPoint(User user, DataPointVO point, String valueStr) saveAPI(User user, String value, String xid) - moved TestUtils to utils package;

- Refactoring ValidationUtils.isCyclicDependency

…n_Cyclic_dependency_for_Meta_Data_Point #3055 Added validation Cyclic dependency for Meta Data Point:

…ces list view Added details for BACnet data points in description field on data source list view

fix/#3061_Fixed_missing_column_typeId_for_event_handlers

…es view #3063

…ces list view

Added option to set modbus data point slave id to range from 0 to 255 instead of range from 1 to 255

Changed selector in data point edit view as well as in point links view and publisher edit view

…_of_list_of_points_in_BacNet_source_in_data_sources_list_view #3058 Improve content of list of points in BacNet source in data sources list view

- Corrected scadalts.security.js.access;

- upgrade gradle version to 8.14.3

- corrected command

- Added setup gradle

- test

- set cache gradle

- added install java 17

- wrapper --gradle-version=8.14.3

- test

- update setup-java to v4

- cache: 'gradle'

- use gradle/actions/setup-gradle with gradle-version: '8.14.3'

- use gradle/actions/setup-gradle with gradle-version: '8.14.3' in: build.yml, master.yml

- update setup-java to v4

…rsion_in_Github_Action #3182 Force Gradle version in Github Action:

- Hide users for ImportTask, hide password toString; - Corrected UserService.populateUserPermissions - when assigning permissions, the permissions set in the user and in the profile are taken into account, so it does not change the behavior of this mechanism; - Corrected encoding: editAsciiFile.jsp, editNodaveS7.jsp; - Change logging level form info to warn in SetUnreliableDataPointsAction.call; - Used tag spring:message in eventList.jsp, img.tag; - Removed gradle-wrapper.properties, corrected gradle.properties; - Corrected SendUtils.java; - Corrected validation activeValueToSet, inactiveValueToSet in EventHandlerVO.validate; - Corrected get watchlists with access in WatchListController;

- Set ERROR for recursiveLoggingLevel;

- Corrected configuration Gradle; (using the wrapper according to the recommendations of the gradle creators) - Corrected BACnetIPDataSourceRT in subscription mode;

- No sorted points on watchlist; (depending on user order config)

Release/2.8.0

github-actions · 2025-10-17T13:55:52Z

Java Script Mocha Unit Test Results

268 tests 268 ✅ 3s ⏱️
70 suites 0 💤
1 files 0 ❌

Results for commit 1cfaed4.

github-actions · 2025-10-17T13:58:26Z

Java JUnit Test Results

3 220 tests 3 220 ✅ 51s ⏱️
128 suites 0 💤
128 files 0 ❌

Results for commit 1cfaed4.

semgrep-app · 2025-10-17T13:58:48Z

Semgrep found 1 ssc-aff5e8de-c638-4356-8a93-120597e35ce9 finding:

scadalts-ui/package-lock.json
- L1253 - Triage

Risk: Affected versions of @babel/traverse, babel-traverse, @babel/plugin-transform-runtime, @babel/preset-env, @babel/helper-define-polyfill-provider, babel-plugin-polyfill-corejs2, babel-plugin-polyfill-corejs3, babel-plugin-polyfill-es-shims, and babel-plugin-polyfill-regenerator are vulnerable to Incomplete List Of Disallowed Inputs. An attacker can exploit a vulnerability in the internal Babel methods path.evaluate() or path.evaluateTruthy() by compiling specially crafted code, potentially resulting in arbitrary code execution during compilation. babel-traverse does not have a fix version. If you are using babel-traverse, switch to @babel/traverse.

Manual Review Advice: A vulnerability from this advisory is reachable if you use Babel to compile untrusted JavaScript

Fix: Upgrade this library to at least version 7.23.2 at Scada-LTS/scadalts-ui/package-lock.json:1253.

Reference(s): GHSA-67hx-6x53-jw92, CVE-2023-45133

github-advanced-security · 2025-10-17T13:58:54Z

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

.github/workflows/semgrep.yml

+    name: semgrep/ci
+    runs-on: ubuntu-latest
+    env:
+      SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
+    container:
+      image: returntocorp/semgrep
+    if: (github.actor != 'dependabot[bot]')
+    steps:
+      - uses: actions/checkout@v4
+      - run: semgrep ci


To fix this problem, the best practice is to explicitly define a minimal set of permissions for the job, restricting the GITHUB_TOKEN to only those access types required for the workflow's actions. In this case, setting permissions: contents: read at the job (semgrep) or workflow root ensures that the token can only read repository contents and does not have unnecessary write access.

Insert a permissions: block with contents: read at the same indentation as runs-on: and other job properties (under jobs.semgrep).

No other imports, methods, or definitions required.

Patrykb0802 and others added 30 commits November 22, 2024 19:16

#3050 XSS in Reports names

65ceac1

#2985 Prevent XSS for REST API by escape String content:

78fb45f

- Fixed create Data Source in new UI; - Fixed update Meta Data Point in new UI;

#3050 XSS in Reports names:

eb20baa

- Fixed Legend report;

#3050 XSS in Reports names:

47ec4e2

- revert Legend report;

#3049 Fixed visible point name in legend report for escape characters:

155e663

- Fixed Legend report;

Merge pull request #3054 from SCADA-LTS/fix/#3049_Fixed_visible_point…

05c83d2

…_name_in_legend_report_for_escape_characters #3049 Fixed visible point name in legend report for escape characters:

Merge pull request #3052 from SCADA-LTS/fix/#3050_XSS_in_Reports_names

a06a15c

#3050 XSS in Reports names

#3036 point name in point properties page has a limited visible length

b71834d

#2985 Prevent XSS for REST API by escape String content:

43364f3

- Fixed EventList.vue;

#2930 fixed high pool priority and database termination sequence: cor…

a0030c1

…rected Common.java;

Merge remote-tracking branch 'origin/release/2.8.0' into fix/#2985_Pr…

a89321f

…event_XSS_for_REST_API_by_escape_String_content2 # Conflicts: # src/com/serotonin/mango/vo/report/SeriesIdentifier.java

#3036 point name in point properties page has a limited visible length:

696441c

- Set max-width is 650px

#2985 Prevent XSS for REST API by escape String content:

63d57e5

- Fixed XSS Event List on new UI;

#2985 Prevent XSS for REST API by escape String content:

c50a0a5

- Reload the page;

Merge pull request #3007 from SCADA-LTS/fix/#2985_Prevent_XSS_for_RES…

bda0e41

…T_API_by_escape_String_content2 #2985 Prevent XSS for REST API by escape String content:

Merge pull request #3053 from SCADA-LTS/feature/#3036_point_name_in_p…

358f13c

…oint_properties_page_has_a_limited_visible_length #3036 point name in point properties page has a limited visible length

#3055 Added validation Cyclic dependency for Meta Data Point:

8218732

- Refactoring ValidationUtils.isCyclicDependency

Merge pull request #3056 from SCADA-LTS/feature/#3055_Added_validatio…

284961e

…n_Cyclic_dependency_for_Meta_Data_Point #3055 Added validation Cyclic dependency for Meta Data Point:

#3058 Improve content of list of points in BacNet source in data sour…

20b86ab

…ces list view Added details for BACnet data points in description field on data source list view

#3061 Fixed missing column typeId for event handlers

82fa866

fix/#3061_Fixed_missing_column_typeId_for_event_handlers

Fixed data point and data source names are not escaped in user profil…

5061af6

…es view #3063

#3061 Fixed missing column typeId for event handlers

6b8d425

#3058 Improve content of list of points in BacNet source in data sour…

e986b13

…ces list view

#2799 Allow modbus tcp slave id to be zero

243934a

Added option to set modbus data point slave id to range from 0 to 255 instead of range from 1 to 255

#2772 Standardise the most convenient DataPoint selector

fe3c514

Changed selector in data point edit view as well as in point links view and publisher edit view

Merge pull request #3059 from SCADA-LTS/feature/#3058_Improve_content…

017ee5c

…_of_list_of_points_in_BacNet_source_in_data_sources_list_view #3058 Improve content of list of points in BacNet source in data sources list view

Limraj and others added 23 commits July 31, 2025 11:50

#3169 Corrected v2.8.0:

7e7b0e9

- Corrected scadalts.security.js.access;

#3182 Force Gradle version in Github Action:

c78499c

- upgrade gradle version to 8.14.3

#3182 Force Gradle version in Github Action:

2580b36

- corrected command

#3182 Force Gradle version in Github Action:

efd0689

- Added setup gradle

#3182 Force Gradle version in Github Action:

403096d

- test

#3182 Force Gradle version in Github Action:

becead7

- test

#3182 Force Gradle version in Github Action:

bb8d356

- test

#3182 Force Gradle version in Github Action:

53e83a2

- set cache gradle

#3182 Force Gradle version in Github Action:

5f34c15

- added install java 17

#3182 Force Gradle version in Github Action:

22118a0

- added install java 17

#3182 Force Gradle version in Github Action:

8dfca24

- wrapper --gradle-version=8.14.3

#3182 Force Gradle version in Github Action:

3274dde

- test

#3182 Force Gradle version in Github Action:

3e14099

- update setup-java to v4

#3182 Force Gradle version in Github Action:

96b4c91

- cache: 'gradle'

#3182 Force Gradle version in Github Action:

dd06155

- use gradle/actions/setup-gradle with gradle-version: '8.14.3'

#3182 Force Gradle version in Github Action:

9c3ea0f

- use gradle/actions/setup-gradle with gradle-version: '8.14.3' in: build.yml, master.yml

#3182 Force Gradle version in Github Action:

fbfe522

- update setup-java to v4

Merge pull request #3183 from SCADA-LTS/feature/#3182_Force_Gradle_ve…

de92ac5

…rsion_in_Github_Action #3182 Force Gradle version in Github Action:

#3169 Corrected v2.8.0:

2481adc

- Set ERROR for recursiveLoggingLevel;

#3169 Corrected v2.8.0:

ab8878b

- Corrected configuration Gradle; (using the wrapper according to the recommendations of the gradle creators) - Corrected BACnetIPDataSourceRT in subscription mode;

#3169 Corrected v2.8.0:

f2a519b

- No sorted points on watchlist; (depending on user order config)

Merge pull request #3051 from SCADA-LTS/release/2.8.0

1cfaed4

Release/2.8.0

Limraj changed the title ~~merge develop to master~~ merge into master from develop Oct 17, 2025

github-advanced-security bot found potential problems Oct 17, 2025

View reviewed changes

Limraj merged commit ae388ed into master Oct 17, 2025
33 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

merge into master from develop #3200

merge into master from develop #3200

Uh oh!

Limraj commented Oct 17, 2025

Uh oh!

github-actions bot commented Oct 17, 2025

Uh oh!

github-actions bot commented Oct 17, 2025

Uh oh!

semgrep-app bot commented Oct 17, 2025

Uh oh!

github-advanced-security bot commented Oct 17, 2025

Uh oh!

Check warning

Copilot Autofix

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

@@ -15,6 +15,8 @@
             jobs:
               semgrep:
                 name: semgrep/ci
+                permissions:
+                  contents: read
                 runs-on: ubuntu-latest
                 env:
                   SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}

merge into master from develop #3200

merge into master from develop #3200

Uh oh!

Conversation

Limraj commented Oct 17, 2025

Uh oh!

github-actions bot commented Oct 17, 2025

Java Script Mocha Unit Test Results

Uh oh!

github-actions bot commented Oct 17, 2025

Java JUnit Test Results

Uh oh!

semgrep-app bot commented Oct 17, 2025

Uh oh!

github-advanced-security bot commented Oct 17, 2025

Uh oh!

Check warning

Copilot Autofix

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants