Merge branch 'master' into PHRAS-3870_record-action-example

.env

@@ -133,7 +133,7 @@ PHRASEANET_DOCKER_REGISTRY=local
 
 # Docker images tag.
 # @run
-PHRASEANET_DOCKER_TAG=4.1.8-rc2
+PHRASEANET_DOCKER_TAG=4.1.8-rc3
 
 # Stack Name
 # An optionnal Name for the stack

.gitignore

@@ -34,6 +34,14 @@
 # Exclude log folder
 /logs
 
+# Exclude backup folder
+/backup
+!/backup/.gitkeep
+
+# Exclude ftp folder
+/ftp
+!/ftp/.gitkeep
+
 # Exclude plugin folder
 /plugins
 # Excluse assets plugin folder

CHANGELOG.md

@@ -1,5 +1,63 @@
 # CHANGELOG
 
+## 4.1.8-rc3
+
+### Update instructions
+
+- Migration patch: no patch to play, just run upgrade for bump version 
+- Elasticsearch index action : none  
+
+### Version summary
+
+- bugfix an minor improvement
+
+### Stack (docker compose)
+
+ - no change
+
+## What's Changed
+* PHRAS-3859 fix gateway fastcgi https default value in https://github.com/alchemy-fr/Phraseanet/pull/4329
+* PHRAS-3860 bin/console user:edit in https://github.com/alchemy-fr/Phraseanet/pull/4328
+* PHRAS-3855 Prod - Facettes : color html tags in https://github.com/alchemy-fr/Phraseanet/pull/4330
+* PHRAS-3860 Sync phraseanet root account info in https://github.com/alchemy-fr/Phraseanet/pull/4331
+* PHRAS-3409: Prod - Edit : A user that have no right is bloqued when trying to edit in https://github.com/alchemy-fr/Phraseanet/pull/4332
+* PHRAS-3872 prod- printed pdf - title content encoding in https://github.com/alchemy-fr/Phraseanet/pull/4336
+* PHRAS-3873: prod -advance search - field , leave only label and real field name in https://github.com/alchemy-fr/Phraseanet/pull/4335
+* PHRAS-3869: secure locale cookie in https://github.com/alchemy-fr/Phraseanet/pull/4333
+* PHRAS-3874 Prod - tools - subdefinition tab - use subdefintion label in https://github.com/alchemy-fr/Phraseanet/pull/4337
+
+
+**Full Changelog**: https://github.com/alchemy-fr/Phraseanet/compare/4.1.8-rc2...4.1.8-rc3
+
+
+
+## 4.1.8-rc2
+
+### Update instructions : 
+
+- Migration patch: no patch to play, just run upgrade for bump version 
+- Elasticsearch index action : none  
+
+### Version summary :
+
+- Docker Nginx vhost,  set security headers 
+- and allow secure cookies 
+
+### Stack (docker compose, helm)
+
+It is now possible to use secure cookies with an env variable
+
+ - `COOKIE_SECURE`  true | false , true activates cookie secure when https is setup
+
+see .env
+
+## What's New
+* PHRAS-3859 set security headers and allow secure cookies by in https://github.com/alchemy-fr/Phraseanet/pull/4324
+* PHRAS-3859 increased security with headers by in https://github.com/alchemy-fr/Phraseanet/pull/4325
+
+
+**Full Changelog**: https://github.com/alchemy-fr/Phraseanet/compare/4.1.8-rc1...4.1.8-rc2
+
 
 ## 4.1.8-rc1
 

Phraseanet-production-client/config/config.js

@@ -13,5 +13,5 @@ module.exports = {
     setupDir: _root + 'tests/setup/node.js',
     karmaConf: _root + 'config/karma.conf.js',
     // change this version when you change JS file for lazy loading
-    assetFileVersion: 87
+    assetFileVersion: 88
 };

Phraseanet-production-client/dist/authenticate.js

@@ -96,7 +96,7 @@ return /******/ (function(modules) { // webpackBootstrap
 /******/ 		if (__webpack_require__.nc) {
 /******/ 			script.setAttribute("nonce", __webpack_require__.nc);
 /******/ 		}
-/******/ 		script.src = __webpack_require__.p + "lazy-" + ({}[chunkId]||chunkId) + ".js?v=87";
+/******/ 		script.src = __webpack_require__.p + "lazy-" + ({}[chunkId]||chunkId) + ".js?v=88";
 /******/ 		var timeout = setTimeout(onScriptComplete, 120000);
 /******/ 		script.onerror = script.onload = onScriptComplete;
 /******/ 		function onScriptComplete() {

Phraseanet-production-client/dist/authenticate.min.js

@@ -96,7 +96,7 @@ return /******/ (function(modules) { // webpackBootstrap
 /******/ 		if (__webpack_require__.nc) {
 /******/ 			script.setAttribute("nonce", __webpack_require__.nc);
 /******/ 		}
-/******/ 		script.src = __webpack_require__.p + "lazy-" + ({}[chunkId]||chunkId) + ".min.js?v=87";
+/******/ 		script.src = __webpack_require__.p + "lazy-" + ({}[chunkId]||chunkId) + ".min.js?v=88";
 /******/ 		var timeout = setTimeout(onScriptComplete, 120000);
 /******/ 		script.onerror = script.onload = onScriptComplete;
 /******/ 		function onScriptComplete() {

Phraseanet-production-client/dist/commons.js

@@ -91,7 +91,7 @@
 /******/ 		if (__webpack_require__.nc) {
 /******/ 			script.setAttribute("nonce", __webpack_require__.nc);
 /******/ 		}
-/******/ 		script.src = __webpack_require__.p + "lazy-" + ({}[chunkId]||chunkId) + ".js?v=87";
+/******/ 		script.src = __webpack_require__.p + "lazy-" + ({}[chunkId]||chunkId) + ".js?v=88";
 /******/ 		var timeout = setTimeout(onScriptComplete, 120000);
 /******/ 		script.onerror = script.onload = onScriptComplete;
 /******/ 		function onScriptComplete() {

Phraseanet-production-client/dist/commons.min.js

@@ -91,7 +91,7 @@
 /******/ 		if (__webpack_require__.nc) {
 /******/ 			script.setAttribute("nonce", __webpack_require__.nc);
 /******/ 		}
-/******/ 		script.src = __webpack_require__.p + "lazy-" + ({}[chunkId]||chunkId) + ".min.js?v=87";
+/******/ 		script.src = __webpack_require__.p + "lazy-" + ({}[chunkId]||chunkId) + ".min.js?v=88";
 /******/ 		var timeout = setTimeout(onScriptComplete, 120000);
 /******/ 		script.onerror = script.onload = onScriptComplete;
 /******/ 		function onScriptComplete() {

Phraseanet-production-client/dist/production.js

@@ -3882,23 +3882,24 @@ var workzoneFacets = function workzoneFacets(services) {
                 if (match && match[2] != null) {
                     // text looks like a color !
                     var colorCode = '#' + match[2];
-                    // add color circle and remove color code from text;
                     var textWithoutColorCode = text.replace('[' + colorCode + ']', '');
                     if (textLimit > 0 && textWithoutColorCode.length > textLimit) {
                         textWithoutColorCode = textWithoutColorCode.substring(0, textLimit) + '…';
                     }
                     // patch
                     type = "COLOR-AGGREGATE";
                     label = textWithoutColorCode;
+                    textWithoutColorCode = (0, _jquery2.default)('<div/>').text(textWithoutColorCode).html(); // escape html
                     tooltip = _.escape(textWithoutColorCode);
+
                     title = '<span class="color-dot" style="background-color: ' + colorCode + ';"></span> ' + tooltip;
                 } else {
                     // keep text as it is, just cut if too long
                     if (textLimit > 0 && text.length > textLimit) {
                         text = text.substring(0, textLimit) + '…';
                     }
                     label = text;
-                    /*title = tooltip = _.escape(text);*/
+                    title = (0, _jquery2.default)('<div/>').text(text).html(); // escape html
                 }
 
                 return {
@@ -3952,8 +3953,6 @@ var workzoneFacets = function workzoneFacets(services) {
             treeSource = _shouldMaskNodes(treeSource, hiddenFacetsList);
         }
 
-        treeSource = _parseColors(treeSource);
-
         treeSource = _colorUnsetText(treeSource);
 
         return _getFacetsTree().reload(treeSource).done(function () {
@@ -3980,18 +3979,6 @@ var workzoneFacets = function workzoneFacets(services) {
         });
     };
 
-    function _parseColors(source) {
-        _.forEach(source, function (facet) {
-            if (!_.isUndefined(facet.children) && facet.children.length > 0) {
-                _.forEach(facet.children, function (child) {
-                    var title = child.title;
-                    child.title = _formatColorText(title.toString());
-                });
-            }
-        });
-        return source;
-    }
-
     function _formatColorText(string) {
         var textLimit = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : 0;
 
@@ -5534,6 +5521,14 @@ var editRecord = function editRecord(services) {
             success: function success(data) {
                 (0, _jquery2.default)('#EDITWINDOW').removeClass('loading').empty().html(data);
 
+                // if the user have not "edit" right in all selected document
+                if (window.recordEditorConfig.state.T_records.length === 0) {
+                    alert(window.recordEditorConfig.notActionableMsg);
+                    (0, _jquery2.default)('#EDITWINDOW').removeClass('loading').hide();
+
+                    return;
+                }
+
                 if (window.recordEditorConfig.hasMultipleDatabases === true) {
                     (0, _jquery2.default)('#EDITWINDOW').removeClass('loading').hide();
 

Phraseanet-production-client/dist/production.min.js

@@ -3882,23 +3882,24 @@ var workzoneFacets = function workzoneFacets(services) {
                 if (match && match[2] != null) {
                     // text looks like a color !
                     var colorCode = '#' + match[2];
-                    // add color circle and remove color code from text;
                     var textWithoutColorCode = text.replace('[' + colorCode + ']', '');
                     if (textLimit > 0 && textWithoutColorCode.length > textLimit) {
                         textWithoutColorCode = textWithoutColorCode.substring(0, textLimit) + '…';
                     }
                     // patch
                     type = "COLOR-AGGREGATE";
                     label = textWithoutColorCode;
+                    textWithoutColorCode = (0, _jquery2.default)('<div/>').text(textWithoutColorCode).html(); // escape html
                     tooltip = _.escape(textWithoutColorCode);
+
                     title = '<span class="color-dot" style="background-color: ' + colorCode + ';"></span> ' + tooltip;
                 } else {
                     // keep text as it is, just cut if too long
                     if (textLimit > 0 && text.length > textLimit) {
                         text = text.substring(0, textLimit) + '…';
                     }
                     label = text;
-                    /*title = tooltip = _.escape(text);*/
+                    title = (0, _jquery2.default)('<div/>').text(text).html(); // escape html
                 }
 
                 return {
@@ -3952,8 +3953,6 @@ var workzoneFacets = function workzoneFacets(services) {
             treeSource = _shouldMaskNodes(treeSource, hiddenFacetsList);
         }
 
-        treeSource = _parseColors(treeSource);
-
         treeSource = _colorUnsetText(treeSource);
 
         return _getFacetsTree().reload(treeSource).done(function () {
@@ -3980,18 +3979,6 @@ var workzoneFacets = function workzoneFacets(services) {
         });
     };
 
-    function _parseColors(source) {
-        _.forEach(source, function (facet) {
-            if (!_.isUndefined(facet.children) && facet.children.length > 0) {
-                _.forEach(facet.children, function (child) {
-                    var title = child.title;
-                    child.title = _formatColorText(title.toString());
-                });
-            }
-        });
-        return source;
-    }
-
     function _formatColorText(string) {
         var textLimit = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : 0;
 
@@ -5534,6 +5521,14 @@ var editRecord = function editRecord(services) {
             success: function success(data) {
                 (0, _jquery2.default)('#EDITWINDOW').removeClass('loading').empty().html(data);
 
+                // if the user have not "edit" right in all selected document
+                if (window.recordEditorConfig.state.T_records.length === 0) {
+                    alert(window.recordEditorConfig.notActionableMsg);
+                    (0, _jquery2.default)('#EDITWINDOW').removeClass('loading').hide();
+
+                    return;
+                }
+
                 if (window.recordEditorConfig.hasMultipleDatabases === true) {
                     (0, _jquery2.default)('#EDITWINDOW').removeClass('loading').hide();
 

Phraseanet-production-client/src/components/record/edit.js

@@ -52,6 +52,14 @@ const editRecord = (services) => {
             success: (data) => {
                 $('#EDITWINDOW').removeClass('loading').empty().html(data);
 
+                // if the user have not "edit" right in all selected document
+                if (window.recordEditorConfig.state.T_records.length === 0) {
+                    alert(window.recordEditorConfig.notActionableMsg);
+                    $('#EDITWINDOW').removeClass('loading').hide();
+
+                    return;
+                }
+
                 if (window.recordEditorConfig.hasMultipleDatabases === true) {
                     $('#EDITWINDOW').removeClass('loading').hide();
 

Phraseanet-production-client/src/components/ui/workzone/facets/index.js

@@ -78,15 +78,16 @@ const workzoneFacets = services => {
                 if(match && match[2] != null) {
                     // text looks like a color !
                     var colorCode = '#' + match[2];
-                    // add color circle and remove color code from text;
                     var textWithoutColorCode = text.replace('[' + colorCode + ']', '');
                     if (textLimit > 0 && textWithoutColorCode.length > textLimit) {
                         textWithoutColorCode = textWithoutColorCode.substring(0, textLimit) + '…';
                     }
                     // patch
                     type = "COLOR-AGGREGATE";
                     label = textWithoutColorCode;
+                    textWithoutColorCode = $('<div/>').text(textWithoutColorCode).html();   // escape html
                     tooltip = _.escape(textWithoutColorCode);
+
                     title = '<span class="color-dot" style="background-color: ' + colorCode + ';"></span> ' + tooltip;
                 }
                 else {
@@ -95,7 +96,7 @@ const workzoneFacets = services => {
                         text = text.substring(0, textLimit) + '…';
                     }
                     label = text;
-                    /*title = tooltip = _.escape(text);*/
+                    title = $('<div/>').text(text).html();   // escape html
                 }
 
                 return {
@@ -154,8 +155,6 @@ const workzoneFacets = services => {
             treeSource = _shouldMaskNodes(treeSource, hiddenFacetsList);
         }
 
-        treeSource = _parseColors(treeSource);
-
         treeSource = _colorUnsetText(treeSource);
 
         return _getFacetsTree().reload(treeSource)
@@ -183,18 +182,6 @@ const workzoneFacets = services => {
             });
     };
 
-    function _parseColors(source) {
-        _.forEach(source, function (facet) {
-            if (!_.isUndefined(facet.children) && (facet.children.length > 0)) {
-                _.forEach(facet.children, function (child) {
-                    var title = child.title;
-                    child.title = _formatColorText(title.toString());
-                });
-            }
-        });
-        return source;
-    }
-
     function _formatColorText(string) {
         var textLimit = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : 0;