jro_apps/redmine Commit - r96:2b86ef8e28d0

0

app/views/documents/_document.rhtml created 644 +3 0

@@ -0,0 +1,3
	1	<p><%= link_to h(document.title), :controller => 'documents', :action => 'show', :id => document %><br />
	2	<% unless document.description.empty? %><%=h truncate document.description, 250 %><br /><% end %>
	3	<em><%= format_time(document.created_on) %></em></p> No newline at end of file

0

app/views/news/_news.rhtml created 644 +4 0

@@ -0,0 +1,4
	1	<p><%= link_to h(news.title), :controller => 'news', :action => 'show', :id => news %><br />
	2	<% unless news.summary.empty? %><%=h news.summary %><br /><% end %>
	3	<em><%= news.author.name %>, <%= format_time(news.created_on) %></em><br />
	4	<%= news.comments_count %> <%= lwr(:label_comment, news.comments_count).downcase %><br /></p>

0

app/helpers/issues_helper.rb +3 -3

                 unless no_html
                   label = content_tag('strong', label)
-                  old_value = content_tag("i", old_value) if old_value
+                  old_value = content_tag("i", h(old_value)) if old_value
-                  old_value = content_tag("strike", old_value) if old_value and !value
+                  old_value = content_tag("strike", h(old_value)) if old_value and !value
-                  value = content_tag("i", value) if value
+                  value = content_tag("i", h(value)) if value
                 end
                 if value

0

app/models/custom_field.rb +1 0

               validates_presence_of :name, :field_format
               validates_uniqueness_of :name
+              validates_format_of :name, :with => /^[\w\s\'\-]*$/i
               validates_inclusion_of :field_format, :in => FIELD_FORMATS.keys
               validates_presence_of :possible_values, :if => Proc.new { |field| field.field_format == "list" }

0

app/models/enumeration.rb +3 -2

             class Enumeration < ActiveRecord::Base
               before_destroy :check_integrity
-            	validates_presence_of :opt, :name
+              validates_presence_of :opt, :name
-            	validates_uniqueness_of :name, :scope => [:opt]
+              validates_uniqueness_of :name, :scope => [:opt]
+              validates_format_of :name, :with => /^[\w\s\'\-]*$/i
             	OPTIONS = {
             	  "IPRI" => :enumeration_issue_priorities,

0

app/models/issue_status.rb +1 0

               validates_presence_of :name
               validates_uniqueness_of :name
+              validates_format_of :name, :with => /^[\w\s\'\-]*$/i
               validates_length_of :html_color, :is => 6
               validates_format_of :html_color, :with => /^[a-f0-9]*$/i

0

app/models/project.rb +1 0

               validates_presence_of :name, :description
               validates_uniqueness_of :name
               validates_associated :custom_values, :on => :update
+              validates_format_of :name, :with => /^[\w\s\'\-]*$/i
               # returns 5 last created projects
               def self.latest

0

app/models/role.rb +1 0

               validates_presence_of :name
               validates_uniqueness_of :name
+              validates_format_of :name, :with => /^[\w\s\'\-]*$/i
             private
               def check_integrity

0

app/models/tracker.rb +2 -1

               validates_presence_of :name
               validates_uniqueness_of :name
+              validates_format_of :name, :with => /^[\w\s\'\-]*$/i
             private
               def check_integrity
                 raise "Can't delete tracker" if Issue.find(:first, :conditions => ["tracker_id=?", self.id])

0

app/models/user.rb +2 -1

               validates_presence_of :login, :firstname, :lastname, :mail
               validates_uniqueness_of :login, :mail
               # Login must contain lettres, numbers, underscores only
-              validates_format_of :login, :with => /^[a-z0-9_]+$/i
+              validates_format_of :firstname, :lastname, :with => /^[\w\s\'\-]*$/i
+              validates_format_of :login, :with => /^[a-z0-9_\-@\.]+$/i
               validates_format_of :mail, :with => /^([^@\s]+)@((?:[-a-z0-9]+\.)+[a-z]{2,})$/i
               # Password length between 4 and 12
               validates_length_of :password, :in => 4..12, :allow_nil => true

0

app/views/admin/projects.rhtml +1 -1

             <% for project in @projects %>
               <tr class="<%= cycle("odd", "even") %>">
             	<td><%= link_to project.name, :controller => 'projects', :action => 'settings', :id => project %>
-            	<td><%= project.description %>
+            	<td><%=h project.description %>
             	<td align="center"><%= image_tag 'true' if project.is_public? %>
             	<td align="center"><%= project.projects_count %>
             	<td align="center"><%= format_date(project.created_on) %>

0

app/views/issues/_history.rhtml +1 -1

             	<% end %>
             	</ul>
             	<% if journal.notes? %>
-                	<%= simple_format auto_link journal.notes %>
+                	<%= simple_format auto_link h(journal.notes) %>
             	<% end %>
             <% end %>

0

app/views/issues/_list_simple.rhtml +1 -1

             			<td><p class="small"><%= issue.project.name %> - <%= issue.tracker.name %><br />
                             <%= issue.status.name %> - <%= format_time(issue.updated_on) %></p></td>
             			<td>
-                            <p class="small"><%= link_to issue.subject, :controller => 'issues', :action => 'show', :id => issue %></p>
+                            <p class="small"><%= link_to h(issue.subject), :controller => 'issues', :action => 'show', :id => issue %></p>
                         </td>
             		</tr>
             		<% end %>

0

app/views/issues/change_status.rhtml +1 -1

-            <h2><%=l(:label_issue)%> #<%= @issue.id %>: <%= @issue.subject %></h2>
+            <h2><%=l(:label_issue)%> #<%= @issue.id %>: <%=h @issue.subject %></h2>
             <%= error_messages_for 'issue' %>
             <%= start_form_tag({:action => 'change_status', :id => @issue}, :class => "tabular") %>

0

app/views/issues/show.rhtml +3 -3

             <%= l(:label_export_to) %><%= link_to 'PDF', {:action => 'export_pdf', :id => @issue}, :class => 'pic picPdf' %>
             </div>
-            <h2><%= @issue.tracker.name %> #<%= @issue.id %> - <%= @issue.subject %></h2>
+            <h2><%= @issue.tracker.name %> #<%= @issue.id %> - <%=h @issue.subject %></h2>
             <div class="box">
             <table width="100%">
             </tr>
             <tr>
                 <td><b><%=l(:field_assigned_to)%> :</b></td><td><%= @issue.assigned_to ? @issue.assigned_to.name : "-" %></td>
-                <td><b><%=l(:field_category)%> :</b></td><td><%= @issue.category ? @issue.category.name : "-" %></td>
+                <td><b><%=l(:field_category)%> :</b></td><td><%=h @issue.category ? @issue.category.name : "-" %></td>
             </tr>
             <tr>
                 <td><b><%=l(:field_author)%> :</b></td><td><%= link_to_user @issue.author %></td>
             <tr>
             <% n = 0
             for custom_value in @custom_values %>
-                <td><b><%= custom_value.custom_field.name %> :</b></td><td><%= show_value custom_value %></td>
+                <td><b><%= custom_value.custom_field.name %> :</b></td><td><%=h show_value custom_value %></td>
             <% n = n + 1
                if (n > 1)
                     n = 0 %>

0

app/views/my/blocks/_calendar.rhtml +1 -1

             		elsif day == i.due_date
             		    image_tag('arrow_to')
             		end %>
-            		<small><%= link_to "#{i.tracker.name} ##{i.id}", :controller => 'issues', :action => 'show', :id => i %>: <%= i.subject.sub(/^(.{30}[^\s]*\s).*$/, '\1 (...)') %></small><br />
+            		<small><%= link_to "#{i.tracker.name} ##{i.id}", :controller => 'issues', :action => 'show', :id => i %>: <%=h i.subject.sub(/^(.{30}[^\s]*\s).*$/, '\1 (...)') %></small><br />
             	<% end %>
                 </td>
             	<%= '</tr><tr height="100">' if day.cwday >= 7 and day!=@date_to %>

0

app/views/my/blocks/_documents.rhtml +3 -11

@@ -1,15 +1,7
1	<h3><%=l(:label_document_plural)%></h3>	1	<h3><%=l(:label_document_plural)%></h3>
2		2
3	<ul>	3	<%= render(:partial => 'documents/document',
4	<% for document in Document.find :all,	4	:collection => Document.find(:all,
5	:limit => 10,	5	:limit => 10,
6	:conditions => "documents.project_id in (#{@user.projects.collect{\|m\| m.id}.join(',')})",	6	:conditions => "documents.project_id in (#{@user.projects.collect{\|m\| m.id}.join(',')})",
7	:include => [:project] %>	7	:include => [:project])) unless @user.projects.empty? %> No newline at end of file
8	<li>
9	<b><%= link_to document.title, :controller => 'documents', :action => 'show', :id => document %></b>
10	<br />
11	<%= truncate document.description, 150 %><br />
12	<em><%= format_time(document.created_on) %></em><br />
13	</li>
14	<% end unless @user.projects.empty? %>
15	</ul> No newline at end of file

0

app/views/my/blocks/_latest_news.rhtml +5 -11

@@ -1,13 +1,7
1	<h3><%=l(:label_news_latest)%></h3>	1	<h3><%=l(:label_news_latest)%></h3>
2		2
3	<ul>	3	<%= render (:partial => 'news/news',
4	<% for news in News.find :all,	4	:collection => News.find(:all,
5	:limit => 10,	5	:limit => 10,
6	:conditions => "news.project_id in (#{@user.projects.collect{\|m\| m.id}.join(',')})",	6	:conditions => "news.project_id in (#{@user.projects.collect{\|m\| m.id}.join(',')})",
7	:include => [:project, :author] %>	7	:include => [:project, :author])) unless @user.projects.empty? %> No newline at end of file
8	<li><%= link_to news.title, :controller => 'news', :action => 'show', :id => news %><br />
9	<% unless news.summary.empty? %><%= news.summary %><br /><% end %>
10	<em><%= news.author.name %>, <%= format_time(news.created_on) %></em><br />
11	</li>
12	<% end unless @user.projects.empty? %>
13	</ul> No newline at end of file

0

app/views/my/page.rhtml +4 -4

-            <h2><%=l(:label_my_page)%></h2>
+            <div class="contextual">
+                <%= link_to l(:label_personalize_page), :action => 'page_layout' %>
-            <div class="topright">
-                <small><%= link_to l(:label_personalize_page), :action => 'page_layout' %></small>
             </div>
+            <h2><%=l(:label_my_page)%></h2>
             <div id="list-top">
             	<% @blocks['top'].each do |b| %>
             	<div class="mypage-box">

0

app/views/my/page_layout.rhtml +4 -12

             </script>
-            <div style="float:right;">
+            <div class="contextual">
+            <span id="indicator" style="display:none"><%= image_tag "loading.gif", :align => "absmiddle" %></span>
             <%= start_form_tag({:action => "add_block"}, :id => "block-form") %>
+            <%= select_tag 'block', "<option></option>" + options_for_select(@block_options), :id => "block-select" %>
-            <%= select_tag 'block', "<option></option>" + options_for_select(@block_options), :id => "block-select", :class => "select-small" %>
-            <small>
             <%= link_to_remote l(:button_add),
                         :url => { :action => "add_block" },
                         :with => "Form.serialize('block-form')",
                         :loading => "Element.show('indicator')",
                         :loaded => "Element.hide('indicator')"
                          %>
-            </small>
+            <%= end_form_tag %> |
-            <%= end_form_tag %>
-            <small>|
             <%= link_to l(:button_save), :action => 'page_layout_save' %> |
             <%= link_to l(:button_cancel), :action => 'page' %>
-            </small>
-            </div>
-            <div style="float:right;margin-right:20px;">
-            <span id="indicator" style="display:none"><%= image_tag "loading.gif" %></span>
             </div>
             <h2><%=l(:label_my_page)%></h2>

0

app/views/news/show.rhtml +2 -2

             <%= link_to_if_authorized l(:button_delete), {:controller => 'news', :action => 'destroy', :id => @news}, :confirm => l(:text_are_you_sure), :post => true, :class => 'pic picDelete' %>
             </div>
-            <h2><%= @news.title %></h2>
+            <h2><%=h @news.title %></h2>
-            <p><em><%= @news.summary %><br />
+            <p><em><%=h @news.summary %><br />
             <%= @news.author.display_name %>, <%= format_time(@news.created_on) %></em></p>
             <br />
             <%= textilizable auto_link @news.description %>

0

app/views/projects/activity.rhtml +6 -6

               <% @events_by_day[day].sort {|x,y| y.created_on <=> x.created_on }.each do |e| %>
                 <li><p>
                 <% if e.is_a? Issue %>
-                  <%= e.created_on.strftime("%H:%M") %> <%= link_to "#{e.tracker.name} ##{e.id}", :controller => 'issues', :action => 'show', :id => e %> (<%= e.status.name %>): <%= e.subject %><br />
+                  <%= e.created_on.strftime("%H:%M") %> <%= link_to "#{e.tracker.name} ##{e.id}", :controller => 'issues', :action => 'show', :id => e %> (<%= e.status.name %>): <%=h e.subject %><br />
                       <i><%= e.author.name %></i>
                 <% elsif e.is_a? News %>
-                  <%= e.created_on.strftime("%H:%M") %> <%=l(:label_news)%>: <%= link_to e.title, :controller => 'news', :action => 'show', :id => e %><br />
+                  <%= e.created_on.strftime("%H:%M") %> <%=l(:label_news)%>: <%= link_to h(e.title), :controller => 'news', :action => 'show', :id => e %><br />
-                      <% unless e.summary.empty? %><%= e.summary %><br /><% end %>
+                      <% unless e.summary.empty? %><%=h e.summary %><br /><% end %>
                       <i><%= e.author.name %></i>
                 <% elsif (e.is_a? Attachment) and (e.container.is_a? Version) %>
-                  <%= e.created_on.strftime("%H:%M") %> <%=l(:label_attachment)%> (<%= e.container.name %>): <%= link_to e.filename, :controller => 'projects', :action => 'list_files', :id => @project %><br />
+                  <%= e.created_on.strftime("%H:%M") %> <%=l(:label_attachment)%> (<%=h e.container.name %>): <%= link_to e.filename, :controller => 'projects', :action => 'list_files', :id => @project %><br />
                     <i><%= e.author.name %></i>
                 <% elsif (e.is_a? Attachment) and (e.container.is_a? Document) %>
-                  <%= e.created_on.strftime("%H:%M") %> <%=l(:label_attachment)%>: <%= e.filename %> (<%= link_to e.container.title, :controller => 'documents', :action => 'show', :id => e.container %>)<br />
+                  <%= e.created_on.strftime("%H:%M") %> <%=l(:label_attachment)%>: <%= e.filename %> (<%= link_to h(e.container.title), :controller => 'documents', :action => 'show', :id => e.container %>)<br />
                     <i><%= e.author.name %></i>
                 <% elsif e.is_a? Document %>
-                  <%= e.created_on.strftime("%H:%M") %> <%=l(:label_document)%>: <%= link_to e.title, :controller => 'documents', :action => 'show', :id => e %><br />
+                  <%= e.created_on.strftime("%H:%M") %> <%=l(:label_document)%>: <%= link_to h(e.title), :controller => 'documents', :action => 'show', :id => e %><br />
                 <% end %>
                 </p></li>

0

app/views/projects/calendar.rhtml +1 -1

             		elsif day == i.due_date
             		    image_tag('arrow_to')
             		end %>
-            		<small><%= link_to "#{i.tracker.name} ##{i.id}", :controller => 'issues', :action => 'show', :id => i %>: <%= i.subject.sub(/^(.{30}[^\s]*\s).*$/, '\1 (...)') %></small><br />
+            		<small><%= link_to "#{i.tracker.name} ##{i.id}", :controller => 'issues', :action => 'show', :id => i %>: <%=h i.subject.sub(/^(.{30}[^\s]*\s).*$/, '\1 (...)') %></small><br />
             	<% end %>
                 </td>
             	<%= '</tr><tr height="100">' if day.cwday >= 7 and day!=@date_to %>

0

app/views/projects/changelog.rhtml +1 -1

                 <ul>
                 <% ver_id = issue.fixed_version_id
                 end %>
-                <li><%= link_to issue.long_id, :controller => 'issues', :action => 'show', :id => issue %> [<%= issue.tracker.name %>]: <%= issue.subject %></li>
+                <li><%= link_to issue.long_id, :controller => 'issues', :action => 'show', :id => issue %> [<%= issue.tracker.name %>]: <%=h issue.subject %></li>
             <% end %>
             </div>

0

app/views/projects/export_issues_pdf.rfpdf +1 -2

             <%	pdf=IfpdfHelper::IFPDF.new
             	pdf.AliasNbPages
             	pdf.footer_date = format_date(Date.today)
-            	pdf.AddPage
             	@issues.each {|i|
-            		render :partial => 'issues/pdf', :locals => { :pdf => pdf, :issue => i }
             		pdf.AddPage
+            		render :partial => 'issues/pdf', :locals => { :pdf => pdf, :issue => i }
             	}
             %>

0

app/views/projects/gantt.rhtml +1 -1

             @issues.each do |i| %>
             	<div style="position: absolute;line-height:1em;height:16px;top:<%= top %>px;left:4px;width:<%= subject_width - 5 %>px;overflow:hidden;">
             	<small><%= link_to "#{i.tracker.name} ##{i.id}", :controller => 'issues', :action => 'show', :id => i %>:
-            	<%= i.subject.sub(/^(.{30}[^\s]*\s).*$/, '\1 (...)') %></small>
+            	<%=h i.subject.sub(/^(.{30}[^\s]*\s).*$/, '\1 (...)') %></small>
             	</div>
             <% top = top + 20
             end %>

0

app/views/projects/list.rhtml +1 -1

             <% for project in @projects %>
               <tr class="<%= cycle("odd", "even") %>">
             	<td><%= link_to project.name, :action => 'show', :id => project %>
-            	<td><%= project.description %>
+            	<td><%=h project.description %>
             	<td align="center"><%= format_date(project.created_on) %>
               </tr>
             <% end %>

0

app/views/projects/list_documents.rhtml +2 -12

@@ -8,16 +8,6
8		8
9	<% documents = @documents.group_by {\|d\| d.category } %>	9	<% documents = @documents.group_by {\|d\| d.category } %>
10	<% documents.each do \|category, docs\| %>	10	<% documents.each do \|category, docs\| %>
11	<h3><%= category.name %></h3>	11	<h3><%= category.name %></h3>
12	<ul>	12	<%= render :partial => 'documents/document', :collection => docs %>
13	<% docs.each do \|d\| %>
14	<li>
15	<b><%= link_to d.title, :controller => 'documents', :action => 'show', :id => d %></b>
16	<br />
17	<%= truncate d.description, 250 %><br />
18	<em><%= format_time(d.created_on) %></em><br />
19	</li>
20
21	<% end %>
22	</ul>
23	<% end %> No newline at end of file	13	<% end %>

0

app/views/projects/list_issues.rhtml +1 -1

             		<td align="center"><%= link_to issue.long_id, :controller => 'issues', :action => 'show', :id => issue %></td>
             		<td align="center" style="font-weight:bold;color:#<%= issue.status.html_color %>;"><%= issue.status.name %></font></td>
             		<td align="center"><%= issue.tracker.name %></td>
-            		<td><%= link_to issue.subject, :controller => 'issues', :action => 'show', :id => issue %></td>
+            		<td><%= link_to h(issue.subject), :controller => 'issues', :action => 'show', :id => issue %></td>
             		<td align="center"><%= issue.author.display_name %></td>
             		<td align="center"><%= format_time(issue.created_on) %></td>
             		<td align="center"><%= format_time(issue.updated_on) %></td>

0

app/views/projects/list_news.rhtml +1 -12

@@ -5,16 +5,5
5	<h2><%=l(:label_news_plural)%></h2>	5	<h2><%=l(:label_news_plural)%></h2>
6		6
7	<% if @news.empty? %><p><i><%= l(:label_no_data) %></i></p><% end %>	7	<% if @news.empty? %><p><i><%= l(:label_no_data) %></i></p><% end %>
8		8	<%= render :partial => 'news/news', :collection => @news %>
9	<ul>
10	<% for news in @news %>
11	<li><%= link_to news.title, :controller => 'news', :action => 'show', :id => news %><br />
12	<% unless news.summary.empty? %><%= news.summary %><br /><% end %>
13	<em><%= news.author.name %>, <%= format_time(news.created_on) %></em><br />
14	<%= news.comments_count %> <%= lwr(:label_comment, news.comments_count).downcase %><br />
15	</li>
16	<% end %>
17	</ul>
18
19
20	<%= pagination_links_full @news_pages %>	9	<%= pagination_links_full @news_pages %>

0

app/views/projects/show.rhtml +5 -10

             <h2><%=l(:label_overview)%></h2>
             <div class="splitcontentleft">
-            	<%= simple_format(auto_link(@project.description)) %>
+            	<%= simple_format(auto_link(h @project.description)) %>
             	<ul>
             	<% unless @project.homepage.empty? %><li><%=l(:field_homepage)%>: <%= auto_link @project.homepage %></li><% end %>
             	<li><%=l(:field_created_on)%>: <%= format_date(@project.created_on) %></li>
             	<% for custom_value in @custom_values %>
             	<% if !custom_value.value.empty? %>
-            	   <li><%= custom_value.custom_field.name%>: <%= show_value(custom_value) %></li>
+            	   <li><%= custom_value.custom_field.name%>: <%=h show_value(custom_value) %></li>
             	<% end %>
             	<% end %>
             	</ul>
                     <% end %>
                     </ul>
                 <% end %>
-                <center><small>[ <%= link_to l(:label_issue_view_all), :controller => 'projects', :action => 'list_issues', :id => @project, :set_filter => 1 %> ]</small></center>
+                <center><small><%= link_to l(:label_issue_view_all), :controller => 'projects', :action => 'list_issues', :id => @project, :set_filter => 1 %></small></center>
               </div>
             </div>
               <div class="box">
                 <h3><%=l(:label_news_latest)%></h3>
-                <% for news in @news %>
+                <%= render :partial => 'news/news', :collection => @news %>
-                  <p><b><%= news.title %></b> <small>(<%= link_to_user news.author %> <%= format_time(news.created_on) %>)</small><br />
+                <center><small><%= link_to l(:label_news_view_all), :controller => 'projects', :action => 'list_news', :id => @project %></small></center>
-                  <%= news.summary %>
-                  <small>[<%= link_to l(:label_read), :controller => 'news', :action => 'show', :id => news %>]</small></p>
-                  <hr />
-                <% end %>
-                <center><small>[ <%= link_to l(:label_news_view_all), :controller => 'projects', :action => 'list_news', :id => @project %> ]</small></center>
               </div>
             </div>

0

app/views/users/_form.rhtml +1 -1

             <% for @custom_value in @custom_values %>
             	<p><%= custom_field_tag_with_label @custom_value %></p>
-            <% end %>
+            <% end if @custom_values%>
             <p><%= f.check_box :admin %></p>
             <p><%= f.check_box :mail_notification %></p>

0

app/views/welcome/index.rhtml +2 -9

               <% if $RDM_WELCOME_TEXT %><p><%= $RDM_WELCOME_TEXT %></p><br /><% end %>
               <div class="box">
             	<h3><%=l(:label_news_latest)%></h3>
-            		<% for news in @news %>
+            		<%= render :partial => 'news/news', :collection => @news %>
-            			<p>
-            			<b><%= news.title %></b> (<%= link_to_user news.author %> <%= format_time(news.created_on) %> - <%= news.project.name %>)<br />
-            			<% unless news.summary.empty? %><%= news.summary %><br /><% end %>
-            			[<%= link_to l(:label_read), :controller => 'news', :action => 'show', :id => news %>]
-            			</p>
-            			<hr />
-            		<% end %>
             	</div>
             </div>
             		<% for project in @projects %>
             			<li>
             			<%= link_to project.name, :controller => 'projects', :action => 'show', :id => project %> (<%= format_time(project.created_on) %>)<br />
-            			<%= project.description %>
+            			<%=h project.description %>
             			</li>
             		<% end %>
             		</ul>

0

public/stylesheets/application.css +3 0

             font-size: 0.8em;
             }
+            .contextual select {
+            font-size: 1em;
+            }
             /***** CSS FORM ******/

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages