Release OpenProject 11.4.1

Author: machisuji

.pkgr.yml

@@ -41,7 +41,7 @@ installer: https://github.com/pkgr/installer.git
 wizards:
   - https://github.com/pkgr/addon-legacy-installer.git
   - ./packaging/addons/openproject-edition
-  - https://github.com/opf/addon-postgres
+  - https://github.com/pkgr/addon-postgres
   - https://github.com/pkgr/addon-apache2.git
   - ./packaging/addons/repositories
   - https://github.com/pkgr/addon-smtp.git

Gemfile

@@ -85,7 +85,7 @@ gem 'escape_utils', '~> 1.0'
 # Syntax highlighting used in html-pipeline with rouge
 gem 'rouge', '~> 3.26.0'
 # HTML sanitization used for html-pipeline
-gem 'sanitize', '~> 5.2.1'
+gem 'sanitize', '~> 6.0.0'
 # HTML autolinking for mails and urls (replaces autolink)
 gem 'rinku', '~> 2.0.4'
 # Version parsing with semver

Gemfile.lock

@@ -610,8 +610,6 @@ GEM
     nokogiri (1.12.5)
       mini_portile2 (~> 2.6.1)
       racc (~> 1.4)
-    nokogumbo (2.0.5)
-      nokogiri (~> 1.8, >= 1.8.4)
     octokit (4.21.0)
       faraday (>= 0.9)
       sawyer (~> 0.8.0, >= 0.5.3)
@@ -836,10 +834,9 @@ GEM
       json (~> 2.1)
       structured_warnings (~> 0.3)
     rubyzip (2.3.0)
-    sanitize (5.2.3)
+    sanitize (6.0.0)
       crass (~> 1.0.2)
-      nokogiri (>= 1.8.0)
-      nokogumbo (~> 2.0)
+      nokogiri (>= 1.12.0)
     sassc (2.4.0)
       ffi (~> 1.9)
     sassc-rails (2.1.2)
@@ -1091,7 +1088,7 @@ DEPENDENCIES
   ruby-prof
   ruby-progressbar (~> 1.11.0)
   rubytree (~> 1.0.0)
-  sanitize (~> 5.2.1)
+  sanitize (~> 6.0.0)
   sassc-rails
   secure_headers (~> 6.3.0)
   selenium-webdriver (~> 3.14)

app/contracts/attachments/prepare_upload_contract.rb

@@ -37,5 +37,24 @@ class PrepareUploadContract < CreateContract
     def validate_direct_uploads_active
       errors.add :base, :not_available unless OpenProject::Configuration.direct_uploads?
     end
+
+    ##
+    # The browser hasn't given a specific content type.
+    # So we don't check the content type here during the prepare_upload step yet.
+    #
+    # We'll do it again later in the FinishDirectUploadJob where the normal create contract
+    # without this opt-out is used, and where a more specific content type may be
+    # determined.
+    def validate_content_type
+      return if pending_content_type?
+
+      super
+    end
+
+    def pending_content_type?
+      return false unless OpenProject::Configuration.direct_uploads?
+
+      model.content_type == OpenProject::ContentTypeDetector::SENSIBLE_DEFAULT
+    end
   end
 end

app/models/group_user.rb

@@ -32,4 +32,7 @@ class GroupUser < ApplicationRecord
   belongs_to :group,
              touch: true
   belongs_to :user
+
+  validates_presence_of :group
+  validates_presence_of :user
 end

app/services/attachments/set_prepared_attributes_service.rb

@@ -50,9 +50,9 @@ def set_prepared_attributes(params)
       model.extend(OpenProject::ChangedBySystem)
       model.change_by_system do
         model.downloads = -1
-        # Set a content type as the file is not present
-        # The real content type will be set by FinishDirectUploadJob
-        model.content_type = params[:content_type] || OpenProject::ContentTypeDetector::SENSIBLE_DEFAULT
+        # Set a preliminary content type as the file is not present
+        # The content type will be updated by the FinishDirectUploadJob if necessary.
+        model.content_type = params[:content_type].presence || OpenProject::ContentTypeDetector::SENSIBLE_DEFAULT
       end
     end
 

app/services/groups/update_service.rb

@@ -32,7 +32,7 @@ class Groups::UpdateService < ::BaseServices::Update
   protected
 
   def persist(call)
-    removed_users = call.result.group_users.select(&:marked_for_destruction?).map(&:user)
+    removed_users = groups_removed_users(call.result)
     member_roles = member_roles_to_prune(removed_users)
     project_ids = member_roles.pluck(:project_id)
     member_role_ids = member_roles.pluck(:id)
@@ -59,13 +59,19 @@ def after_perform(call)
     call
   end
 
+  def groups_removed_users(group)
+    group.group_users.select(&:marked_for_destruction?).map(&:user).compact
+  end
+
   def remove_member_roles(member_role_ids)
     ::Groups::CleanupInheritedRolesService
       .new(model, current_user: user)
       .call(member_role_ids: member_role_ids)
   end
 
   def member_roles_to_prune(users)
+    return MemberRole.none if users.empty?
+
     MemberRole
       .includes(member: :member_roles)
       .where(inherited_from: model.members.joins(:member_roles).select('member_roles.id'))

app/workers/attachments/finish_direct_upload_job.rb

@@ -42,30 +42,53 @@ def perform(attachment_id)
       return Rails.logger.error("File for attachment #{attachment_id} was not uploaded.")
     end
 
-    begin
-      set_attributes_from_file(attachment, local_file)
-      save_attachment(attachment)
-      journalize_container(attachment)
-    ensure
-      File.unlink(local_file.path) if File.exist?(local_file.path)
+    User.execute_as(attachment.author) do
+      attach_uploaded_file(attachment, local_file)
     end
   end
 
   private
 
+  def attach_uploaded_file(attachment, local_file)
+    set_attributes_from_file(attachment, local_file)
+    validate_attachment(attachment)
+    save_attachment(attachment)
+    journalize_container(attachment)
+    attachment_created_event(attachment)
+  rescue StandardError => e
+    ::OpenProject.logger.error e
+    attachment.destroy
+  ensure
+    File.unlink(local_file.path) if File.exist?(local_file.path)
+  end
+
   def set_attributes_from_file(attachment, local_file)
-    attachment.downloads = 0
-    attachment.set_file_size local_file
-    attachment.set_content_type local_file
-    attachment.set_digest local_file
+    attachment.extend(OpenProject::ChangedBySystem)
+    attachment.change_by_system do
+      attachment.downloads = 0
+      attachment.set_file_size local_file
+      attachment.set_content_type local_file
+      attachment.set_digest local_file
+    end
   end
 
   def save_attachment(attachment)
-    User.execute_as(attachment.author) do
-      attachment.save! if attachment.changed?
+    attachment.save! if attachment.changed?
+  end
+
+  def validate_attachment(attachment)
+    contract = create_contract attachment
+
+    unless contract.valid?
+      errors = contract.errors.full_messages.join(", ")
+      raise "Failed to validate attachment #{attachment.id}: #{errors}"
     end
   end
 
+  def create_contract(attachment)
+    ::Attachments::CreateContract.new(attachment, attachment.author)
+  end
+
   def journalize_container(attachment)
     journable = attachment.container
 
@@ -93,4 +116,11 @@ def touch_journable(journable)
     timestamps = attributes.index_with { Time.now }
     journable.update_columns(timestamps) if timestamps.any?
   end
+
+  def attachment_created_event(attachment)
+    OpenProject::Notifications.send(
+      OpenProject::Events::ATTACHMENT_CREATED,
+      attachment: attachment
+    )
+  end
 end

config/locales/crowdin/es.yml

@@ -541,7 +541,7 @@ es:
         error_enterprise_only: "solo está disponible en OpenProject Enterprise Edition"
         error_unauthorized: "no se puede acceder."
         error_readonly: "se intentó escribir pero no se puede escribir."
-        email: "is not a valid email address."
+        email: "no es una dirección de correo válida."
         empty: "No puede estar vacío."
         even: "debe ser incluido."
         exclusion: "está reservado."

config/locales/crowdin/js-ar.yml

@@ -289,7 +289,7 @@ ar:
             current_new_feature_html: >
               The release contains various new features and improvements: <br> <ul class="%{list_styling_class}"> <li>New button in header navigation to create projects, users and work packages.</li> <li>A new invite modal for users, groups and placeholder users allows to easily add or invite new users and assign them to work packages.</li> <li>GitHub integration into OpenProject.</li> <li>API v3 extensions for groups and more, i.e. create, read, update and delete groups and group members through the API.</li> <li>Multi-selection for project custom fields of type list.</li> <li>Creation of backup from the web interface.</li> </ul>
           bim:
-            learn_about_link: https://www.openproject.org/openproject-11-4-release
+            learn_about_link: https://www.openproject.org/blog/openproject-11-4-release
             current_new_feature_html: >
               The release contains various new features and improvements: <br> <ul class="%{list_styling_class}"> <li>Take a look at our <a href="https://github.com/opf/openproject-revit-add-in">Revit Add-in</a> which lets you work on BCF work packages directly in Revit.</li> <li>IFC properties got a dedicated pane. Copying GUIDs has never been easier.</li> <li>Reverse clipping plane direction in BCF viewpoint and become compliant with future BCF 3.0 (Now same direction as Solibri). <li>Fixed viewing IFC models on mobile.</li> <li>Fixed export of work package views with BCF snapshot column.</li> </ul>
     label_activate: "تفعيل"
@@ -761,7 +761,7 @@ ar:
       no_results:
         title: لا يوجد مجموعات عمل لعرضها.
         description: إما أنه لا يوجد ما تم إنشاؤه أو أن جميع مجموعات العمل قد تمت فلترتها.
-      limited_results: Only %{count} work packages can be shown in manual sorting mode. Please reduce the results by filtering.
+      limited_results: Only %{count} work packages can be shown in manual sorting mode. Please reduce the results by filtering, or switch to automatic sorting.
       property_groups:
         details: "تفاصيل"
         people: "الناس"