jro_apps/redmine Commit - r15607:7b3f2b51c0ea

Add length validations for string fields (#24283)....

Jean-Philippe Lang -

r15607:7b3f2b51c0ea

parent child

Context file:

r15607:7b3f2b51c0ea

Collapse all files

app/models/custom_field.rb +1 0

              # Redmine - project management software
              # Copyright (C) 2006-2016  Jean-Philippe Lang
              #
              # This program is free software; you can redistribute it and/or
              # modify it under the terms of the GNU General Public License
              # as published by the Free Software Foundation; either version 2
              # of the License, or (at your option) any later version.
              #
              # This program is distributed in the hope that it will be useful,
              # but WITHOUT ANY WARRANTY; without even the implied warranty of
              # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
              # GNU General Public License for more details.
              #
              # You should have received a copy of the GNU General Public License
              # along with this program; if not, write to the Free Software
              # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
              class CustomField < ActiveRecord::Base
                include Redmine::SafeAttributes
                include Redmine::SubclassFactory
                has_many :enumerations,
                         lambda { order(:position) },
                         :class_name => 'CustomFieldEnumeration',
                         :dependent => :delete_all
                has_many :custom_values, :dependent => :delete_all
                has_and_belongs_to_many :roles, :join_table => "#{table_name_prefix}custom_fields_roles#{table_name_suffix}", :foreign_key => "custom_field_id"
                acts_as_positioned
                serialize :possible_values
                store :format_store
                validates_presence_of :name, :field_format
                validates_uniqueness_of :name, :scope => :type
                validates_length_of :name, :maximum => 30
+               validates_length_of :regexp, maximum: 30
                validates_inclusion_of :field_format, :in => Proc.new { Redmine::FieldFormat.available_formats }
                validate :validate_custom_field
                attr_protected :id
                before_validation :set_searchable
                before_save do |field|
                  field.format.before_custom_field_save(field)
                end
                after_save :handle_multiplicity_change
                after_save do |field|
                  if field.visible_changed? && field.visible
                    field.roles.clear
                  end
                end
                scope :sorted, lambda { order(:position) }
                scope :visible, lambda {|*args|
                  user = args.shift || User.current
                  if user.admin?
                    # nop
                  elsif user.memberships.any?
                    where("#{table_name}.visible = ? OR #{table_name}.id IN (SELECT DISTINCT cfr.custom_field_id FROM #{Member.table_name} m" +
                      " INNER JOIN #{MemberRole.table_name} mr ON mr.member_id = m.id" +
                      " INNER JOIN #{table_name_prefix}custom_fields_roles#{table_name_suffix} cfr ON cfr.role_id = mr.role_id" +
                      " WHERE m.user_id = ?)",
                      true, user.id)
                  else
                    where(:visible => true)
                  end
                }
                def visible_by?(project, user=User.current)
                  visible? || user.admin?
                end
                safe_attributes 'name',
                  'field_format',
                  'possible_values',
                  'regexp',
                  'min_lnegth',
                  'max_length',
                  'is_required',
                  'is_for_all',
                  'is_filter',
                  'position',
                  'searchable',
                  'default_value',
                  'editable',
                  'visible',
                  'multiple',
                  'description',
                  'role_ids',
                  'url_pattern',
                  'text_formatting',
                  'edit_tag_style',
                  'user_role',
                  'version_status',
                  'extensions_allowed'
                def format
                  @format ||= Redmine::FieldFormat.find(field_format)
                end
                def field_format=(arg)
                  # cannot change format of a saved custom field
                  if new_record?
                    @format = nil
                    super
                  end
                end
                def set_searchable
                  # make sure these fields are not searchable
                  self.searchable = false unless format.class.searchable_supported
                  # make sure only these fields can have multiple values
                  self.multiple = false unless format.class.multiple_supported
                  true
                end
                def validate_custom_field
                  format.validate_custom_field(self).each do |attribute, message|
                    errors.add attribute, message
                  end
                  if regexp.present?
                    begin
                      Regexp.new(regexp)
                    rescue
                      errors.add(:regexp, :invalid)
                    end
                  end
                  if default_value.present?
                    validate_field_value(default_value).each do |message|
                      errors.add :default_value, message
                    end
                  end
                end
                def possible_custom_value_options(custom_value)
                  format.possible_custom_value_options(custom_value)
                end
                def possible_values_options(object=nil)
                  if object.is_a?(Array)
                    object.map {|o| format.possible_values_options(self, o)}.reduce(:&) || []
                  else
                    format.possible_values_options(self, object) || []
                  end
                end
                def possible_values
                  values = read_attribute(:possible_values)
                  if values.is_a?(Array)
                    values.each do |value|
                      value.to_s.force_encoding('UTF-8')
                    end
                    values
                  else
                    []
                  end
                end
                # Makes possible_values accept a multiline string
                def possible_values=(arg)
                  if arg.is_a?(Array)
                    values = arg.compact.map {|a| a.to_s.strip}.reject(&:blank?)
                    write_attribute(:possible_values, values)
                  else
                    self.possible_values = arg.to_s.split(/[\n\r]+/)
                  end
                end
                def set_custom_field_value(custom_field_value, value)
                  format.set_custom_field_value(self, custom_field_value, value)
                end
                def cast_value(value)
                  format.cast_value(self, value)
                end
                def value_from_keyword(keyword, customized)
                  format.value_from_keyword(self, keyword, customized)
                end
                # Returns the options hash used to build a query filter for the field
                def query_filter_options(query)
                  format.query_filter_options(self, query)
                end
                def totalable?
                  format.totalable_supported
                end
                # Returns a ORDER BY clause that can used to sort customized
                # objects by their value of the custom field.
                # Returns nil if the custom field can not be used for sorting.
                def order_statement
                  return nil if multiple?
                  format.order_statement(self)
                end
                # Returns a GROUP BY clause that can used to group by custom value
                # Returns nil if the custom field can not be used for grouping.
                def group_statement
                  return nil if multiple?
                  format.group_statement(self)
                end
                def join_for_order_statement
                  format.join_for_order_statement(self)
                end
                def visibility_by_project_condition(project_key=nil, user=User.current, id_column=nil)
                  if visible? || user.admin?
                    "1=1"
                  elsif user.anonymous?
                    "1=0"
                  else
                    project_key ||= "#{self.class.customized_class.table_name}.project_id"
                    id_column ||= id
                    "#{project_key} IN (SELECT DISTINCT m.project_id FROM #{Member.table_name} m" +
                      " INNER JOIN #{MemberRole.table_name} mr ON mr.member_id = m.id" +
                      " INNER JOIN #{table_name_prefix}custom_fields_roles#{table_name_suffix} cfr ON cfr.role_id = mr.role_id" +
                      " WHERE m.user_id = #{user.id} AND cfr.custom_field_id = #{id_column})"
                  end
                end
                def self.visibility_condition
                  if user.admin?
                    "1=1"
                  elsif user.anonymous?
                    "#{table_name}.visible"
                  else
                    "#{project_key} IN (SELECT DISTINCT m.project_id FROM #{Member.table_name} m" +
                      " INNER JOIN #{MemberRole.table_name} mr ON mr.member_id = m.id" +
                      " INNER JOIN #{table_name_prefix}custom_fields_roles#{table_name_suffix} cfr ON cfr.role_id = mr.role_id" +
                      " WHERE m.user_id = #{user.id} AND cfr.custom_field_id = #{id})"
                  end
                end
                def <=>(field)
                  position <=> field.position
                end
                # Returns the class that values represent
                def value_class
                  format.target_class if format.respond_to?(:target_class)
                end
                def self.customized_class
                  self.name =~ /^(.+)CustomField$/
                  $1.constantize rescue nil
                end
                # to move in project_custom_field
                def self.for_all
                  where(:is_for_all => true).order('position').to_a
                end
                def type_name
                  nil
                end
                # Returns the error messages for the given value
                # or an empty array if value is a valid value for the custom field
                def validate_custom_value(custom_value)
                  value = custom_value.value
                  errs = format.validate_custom_value(custom_value)
                  unless errs.any?
                    if value.is_a?(Array)
                      if !multiple?
                        errs << ::I18n.t('activerecord.errors.messages.invalid')
                      end
                      if is_required? && value.detect(&:present?).nil?
                        errs << ::I18n.t('activerecord.errors.messages.blank')
                      end
                    else
                      if is_required? && value.blank?
                        errs << ::I18n.t('activerecord.errors.messages.blank')
                      end
                    end
                  end
                  errs
                end
                # Returns the error messages for the default custom field value
                def validate_field_value(value)
                  validate_custom_value(CustomFieldValue.new(:custom_field => self, :value => value))
                end
                # Returns true if value is a valid value for the custom field
                def valid_field_value?(value)
                  validate_field_value(value).empty?
                end
                def after_save_custom_value(custom_value)
                  format.after_save_custom_value(self, custom_value)
                end
                def format_in?(*args)
                  args.include?(field_format)
                end
                def self.human_attribute_name(attribute_key_name, *args)
                  attr_name = attribute_key_name.to_s
                  if attr_name == 'url_pattern'
                    attr_name = "url"
                  end
                  super(attr_name, *args)
                end
                protected
                # Removes multiple values for the custom field after setting the multiple attribute to false
                # We kepp the value with the highest id for each customized object
                def handle_multiplicity_change
                  if !new_record? && multiple_was && !multiple
                    ids = custom_values.
                      where("EXISTS(SELECT 1 FROM #{CustomValue.table_name} cve WHERE cve.custom_field_id = #{CustomValue.table_name}.custom_field_id" +
                        " AND cve.customized_type = #{CustomValue.table_name}.customized_type AND cve.customized_id = #{CustomValue.table_name}.customized_id" +
                        " AND cve.id > #{CustomValue.table_name}.id)").
                      pluck(:id)
                    if ids.any?
                      custom_values.where(:id => ids).delete_all
                    end
                  end
                end
              end
              require_dependency 'redmine/field_format'

app/models/repository.rb +2 0

              # Redmine - project management software
              # Copyright (C) 2006-2016  Jean-Philippe Lang
              #
              # This program is free software; you can redistribute it and/or
              # modify it under the terms of the GNU General Public License
              # as published by the Free Software Foundation; either version 2
              # of the License, or (at your option) any later version.
              #
              # This program is distributed in the hope that it will be useful,
              # but WITHOUT ANY WARRANTY; without even the implied warranty of
              # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
              # GNU General Public License for more details.
              #
              # You should have received a copy of the GNU General Public License
              # along with this program; if not, write to the Free Software
              # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
              class ScmFetchError < Exception; end
              class Repository < ActiveRecord::Base
                include Redmine::Ciphering
                include Redmine::SafeAttributes
                # Maximum length for repository identifiers
                IDENTIFIER_MAX_LENGTH = 255
                belongs_to :project
                has_many :changesets, lambda{order("#{Changeset.table_name}.committed_on DESC, #{Changeset.table_name}.id DESC")}
                has_many :filechanges, :class_name => 'Change', :through => :changesets
                serialize :extra_info
                before_validation :normalize_identifier
                before_save :check_default
                # Raw SQL to delete changesets and changes in the database
                # has_many :changesets, :dependent => :destroy is too slow for big repositories
                before_destroy :clear_changesets
+               validates_length_of :login, maximum: 60, allow_nil: true
                validates_length_of :password, :maximum => 255, :allow_nil => true
+               validates_length_of :root_url, :url, maximum: 255
                validates_length_of :identifier, :maximum => IDENTIFIER_MAX_LENGTH, :allow_blank => true
                validates_uniqueness_of :identifier, :scope => :project_id
                validates_exclusion_of :identifier, :in => %w(browse show entry raw changes annotate diff statistics graph revisions revision)
                # donwcase letters, digits, dashes, underscores but not digits only
                validates_format_of :identifier, :with => /\A(?!\d+$)[a-z0-9\-_]*\z/, :allow_blank => true
                # Checks if the SCM is enabled when creating a repository
                validate :repo_create_validation, :on => :create
                validate :validate_repository_path
                attr_protected :id
                safe_attributes 'identifier',
                  'login',
                  'password',
                  'path_encoding',
                  'log_encoding',
                  'is_default'
                safe_attributes 'url',
                  :if => lambda {|repository, user| repository.new_record?}
                def repo_create_validation
                  unless Setting.enabled_scm.include?(self.class.name.demodulize)
                    errors.add(:type, :invalid)
                  end
                end
                def self.human_attribute_name(attribute_key_name, *args)
                  attr_name = attribute_key_name.to_s
                  if attr_name == "log_encoding"
                    attr_name = "commit_logs_encoding"
                  end
                  super(attr_name, *args)
                end
                # Removes leading and trailing whitespace
                def url=(arg)
                  write_attribute(:url, arg ? arg.to_s.strip : nil)
                end
                # Removes leading and trailing whitespace
                def root_url=(arg)
                  write_attribute(:root_url, arg ? arg.to_s.strip : nil)
                end
                def password
                  read_ciphered_attribute(:password)
                end
                def password=(arg)
                  write_ciphered_attribute(:password, arg)
                end
                def scm_adapter
                  self.class.scm_adapter_class
                end
                def scm
                  unless @scm
                    @scm = self.scm_adapter.new(url, root_url,
                                                login, password, path_encoding)
                    if root_url.blank? && @scm.root_url.present?
                      update_attribute(:root_url, @scm.root_url)
                    end
                  end
                  @scm
                end
                def scm_name
                  self.class.scm_name
                end
                def name
                  if identifier.present?
                    identifier
                  elsif is_default?
                    l(:field_repository_is_default)
                  else
                    scm_name
                  end
                end
                def identifier=(identifier)
                  super unless identifier_frozen?
                end
                def identifier_frozen?
                  errors[:identifier].blank? && !(new_record? || identifier.blank?)
                end
                def identifier_param
                  if is_default?
                    nil
                  elsif identifier.present?
                    identifier
                  else
                    id.to_s
                  end
                end
                def <=>(repository)
                  if is_default?
                    -1
                  elsif repository.is_default?
 
                  else
                    identifier.to_s <=> repository.identifier.to_s
                  end
                end
                def self.find_by_identifier_param(param)
                  if param.to_s =~ /^\d+$/
                    find_by_id(param)
                  else
                    find_by_identifier(param)
                  end
                end
                # TODO: should return an empty hash instead of nil to avoid many ||{}
                def extra_info
                  h = read_attribute(:extra_info)
                  h.is_a?(Hash) ? h : nil
                end
                def merge_extra_info(arg)
                  h = extra_info || {}
                  return h if arg.nil?
                  h.merge!(arg)
                  write_attribute(:extra_info, h)
                end
                def report_last_commit
                  true
                end
                def supports_cat?
                  scm.supports_cat?
                end
                def supports_annotate?
                  scm.supports_annotate?
                end
                def supports_all_revisions?
                  true
                end
                def supports_directory_revisions?
                  false
                end
                def supports_revision_graph?
                  false
                end
                def entry(path=nil, identifier=nil)
                  scm.entry(path, identifier)
                end
                def scm_entries(path=nil, identifier=nil)
                  scm.entries(path, identifier)
                end
                protected :scm_entries
                def entries(path=nil, identifier=nil)
                  entries = scm_entries(path, identifier)
                  load_entries_changesets(entries)
                  entries
                end
                def branches
                  scm.branches
                end
                def tags
                  scm.tags
                end
                def default_branch
                  nil
                end
                def properties(path, identifier=nil)
                  scm.properties(path, identifier)
                end
                def cat(path, identifier=nil)
                  scm.cat(path, identifier)
                end
                def diff(path, rev, rev_to)
                  scm.diff(path, rev, rev_to)
                end
                def diff_format_revisions(cs, cs_to, sep=':')
                  text = ""
                  text << cs_to.format_identifier + sep if cs_to
                  text << cs.format_identifier if cs
                  text
                end
                # Returns a path relative to the url of the repository
                def relative_path(path)
                  path
                end
                # Finds and returns a revision with a number or the beginning of a hash
                def find_changeset_by_name(name)
                  return nil if name.blank?
                  s = name.to_s
                  if s.match(/^\d*$/)
                    changesets.where("revision = ?", s).first
                  else
                    changesets.where("revision LIKE ?", s + '%').first
                  end
                end
                def latest_changeset
                  @latest_changeset ||= changesets.first
                end
                # Returns the latest changesets for +path+
                # Default behaviour is to search in cached changesets
                def latest_changesets(path, rev, limit=10)
                  if path.blank?
                    changesets.
                      reorder("#{Changeset.table_name}.committed_on DESC, #{Changeset.table_name}.id DESC").
                      limit(limit).
                      preload(:user).
                      to_a
                  else
                    filechanges.
                      where("path = ?", path.with_leading_slash).
                      reorder("#{Changeset.table_name}.committed_on DESC, #{Changeset.table_name}.id DESC").
                      limit(limit).
                      preload(:changeset => :user).
                      collect(&:changeset)
                  end
                end
                def scan_changesets_for_issue_ids
                  self.changesets.each(&:scan_comment_for_issue_ids)
                end
                # Returns an array of committers usernames and associated user_id
                def committers
                  @committers ||= Changeset.where(:repository_id => id).distinct.pluck(:committer, :user_id)
                end
                # Maps committers username to a user ids
                def committer_ids=(h)
                  if h.is_a?(Hash)
                    committers.each do |committer, user_id|
                      new_user_id = h[committer]
                      if new_user_id && (new_user_id.to_i != user_id.to_i)
                        new_user_id = (new_user_id.to_i > 0 ? new_user_id.to_i : nil)
                        Changeset.where(["repository_id = ? AND committer = ?", id, committer]).
                          update_all("user_id = #{new_user_id.nil? ? 'NULL' : new_user_id}")
                      end
                    end
                    @committers            = nil
                    @found_committer_users = nil
                    true
                  else
                    false
                  end
                end
                # Returns the Redmine User corresponding to the given +committer+
                # It will return nil if the committer is not yet mapped and if no User
                # with the same username or email was found
                def find_committer_user(committer)
                  unless committer.blank?
                    @found_committer_users ||= {}
                    return @found_committer_users[committer] if @found_committer_users.has_key?(committer)
                    user = nil
                    c = changesets.where(:committer => committer).
                          includes(:user).references(:user).first
                    if c && c.user
                      user = c.user
                    elsif committer.strip =~ /^([^<]+)(<(.*)>)?$/
                      username, email = $1.strip, $3
                      u = User.find_by_login(username)
                      u ||= User.find_by_mail(email) unless email.blank?
                      user = u
                    end
                    @found_committer_users[committer] = user
                    user
                  end
                end
                def repo_log_encoding
                  encoding = log_encoding.to_s.strip
                  encoding.blank? ? 'UTF-8' : encoding
                end
                # Fetches new changesets for all repositories of active projects
                # Can be called periodically by an external script
                # eg. ruby script/runner "Repository.fetch_changesets"
                def self.fetch_changesets
                  Project.active.has_module(:repository).all.each do |project|
                    project.repositories.each do |repository|
                      begin
                        repository.fetch_changesets
                      rescue Redmine::Scm::Adapters::CommandFailed => e
                        logger.error "scm: error during fetching changesets: #{e.message}"
                      end
                    end
                  end
                end
                # scan changeset comments to find related and fixed issues for all repositories
                def self.scan_changesets_for_issue_ids
                  all.each(&:scan_changesets_for_issue_ids)
                end
                def self.scm_name
                  'Abstract'
                end
                def self.available_scm
                  subclasses.collect {|klass| [klass.scm_name, klass.name]}
                end
                def self.factory(klass_name, *args)
                  repository_class(klass_name).new(*args) rescue nil
                end
                def self.repository_class(class_name)
                  class_name = class_name.to_s.camelize
                  if Redmine::Scm::Base.all.include?(class_name)
                    "Repository::#{class_name}".constantize
                  end
                end
                def self.scm_adapter_class
                  nil
                end
                def self.scm_command
                  ret = ""
                  begin
                    ret = self.scm_adapter_class.client_command if self.scm_adapter_class
                  rescue Exception => e
                    logger.error "scm: error during get command: #{e.message}"
                  end
                  ret
                end
                def self.scm_version_string
                  ret = ""
                  begin
                    ret = self.scm_adapter_class.client_version_string if self.scm_adapter_class
                  rescue Exception => e
                    logger.error "scm: error during get version string: #{e.message}"
                  end
                  ret
                end
                def self.scm_available
                  ret = false
                  begin
                    ret = self.scm_adapter_class.client_available if self.scm_adapter_class
                  rescue Exception => e
                    logger.error "scm: error during get scm available: #{e.message}"
                  end
                  ret
                end
                def set_as_default?
                  new_record? && project && Repository.where(:project_id => project.id).empty?
                end
                # Returns a hash with statistics by author in the following form:
                # {
                #   "John Smith" => { :commits => 45, :changes => 324 },
                #   "Bob" => { ... }
                # }
                #
                # Notes:
                # - this hash honnors the users mapping defined for the repository
                def stats_by_author
                  commits = Changeset.where("repository_id = ?", id).select("committer, user_id, count(*) as count").group("committer, user_id")
                  #TODO: restore ordering ; this line probably never worked
                  #commits.to_a.sort! {|x, y| x.last <=> y.last}
                  changes = Change.joins(:changeset).where("#{Changeset.table_name}.repository_id = ?", id).select("committer, user_id, count(*) as count").group("committer, user_id")
                  user_ids = changesets.map(&:user_id).compact.uniq
                  authors_names = User.where(:id => user_ids).inject({}) do |memo, user|
                    memo[user.id] = user.to_s
                    memo
                  end
                  (commits + changes).inject({}) do |hash, element|
                    mapped_name = element.committer
                    if username = authors_names[element.user_id.to_i]
                      mapped_name = username
                    end
                    hash[mapped_name] ||= { :commits_count => 0, :changes_count => 0 }
                    if element.is_a?(Changeset)
                      hash[mapped_name][:commits_count] += element.count.to_i
                    else
                      hash[mapped_name][:changes_count] += element.count.to_i
                    end
                    hash
                  end
                end
                # Returns a scope of changesets that come from the same commit as the given changeset
                # in different repositories that point to the same backend
                def same_commits_in_scope(scope, changeset)
                  scope = scope.joins(:repository).where(:repositories => {:url => url, :root_url => root_url, :type => type})
                  if changeset.scmid.present?
                    scope = scope.where(:scmid => changeset.scmid)
                  else
                    scope = scope.where(:revision => changeset.revision)
                  end
                  scope
                end
                protected
                # Validates repository url based against an optional regular expression
                # that can be set in the Redmine configuration file.
                def validate_repository_path(attribute=:url)
                  regexp = Redmine::Configuration["scm_#{scm_name.to_s.downcase}_path_regexp"]
                  if changes[attribute] && regexp.present?
                    regexp = regexp.to_s.strip.gsub('%project%') {Regexp.escape(project.try(:identifier).to_s)}
                    unless send(attribute).to_s.match(Regexp.new("\\A#{regexp}\\z"))
                      errors.add(attribute, :invalid)
                    end
                  end
                end
                def normalize_identifier
                  self.identifier = identifier.to_s.strip
                end
                def check_default
                  if !is_default? && set_as_default?
                    self.is_default = true
                  end
                  if is_default? && is_default_changed?
                    Repository.where(["project_id = ?", project_id]).update_all(["is_default = ?", false])
                  end
                end
                def load_entries_changesets(entries)
                  if entries
                    entries.each do |entry|
                      if entry.lastrev && entry.lastrev.identifier
                        entry.changeset = find_changeset_by_name(entry.lastrev.identifier)
                      end
                    end
                  end
                end
                private
                # Deletes repository data
                def clear_changesets
                  cs = Changeset.table_name
                  ch = Change.table_name
                  ci = "#{table_name_prefix}changesets_issues#{table_name_suffix}"
                  cp = "#{table_name_prefix}changeset_parents#{table_name_suffix}"
                  self.class.connection.delete("DELETE FROM #{ch} WHERE #{ch}.changeset_id IN (SELECT #{cs}.id FROM #{cs} WHERE #{cs}.repository_id = #{id})")
                  self.class.connection.delete("DELETE FROM #{ci} WHERE #{ci}.changeset_id IN (SELECT #{cs}.id FROM #{cs} WHERE #{cs}.repository_id = #{id})")
                  self.class.connection.delete("DELETE FROM #{cp} WHERE #{cp}.changeset_id IN (SELECT #{cs}.id FROM #{cs} WHERE #{cs}.repository_id = #{id})")
                  self.class.connection.delete("DELETE FROM #{cs} WHERE #{cs}.repository_id = #{id}")
                end
              end

app/models/user.rb +1 0

              # Redmine - project management software
              # Copyright (C) 2006-2016  Jean-Philippe Lang
              #
              # This program is free software; you can redistribute it and/or
              # modify it under the terms of the GNU General Public License
              # as published by the Free Software Foundation; either version 2
              # of the License, or (at your option) any later version.
              #
              # This program is distributed in the hope that it will be useful,
              # but WITHOUT ANY WARRANTY; without even the implied warranty of
              # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
              # GNU General Public License for more details.
              #
              # You should have received a copy of the GNU General Public License
              # along with this program; if not, write to the Free Software
              # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
              require "digest/sha1"
              class User < Principal
                include Redmine::SafeAttributes
                # Different ways of displaying/sorting users
                USER_FORMATS = {
                  :firstname_lastname => {
                      :string => '#{firstname} #{lastname}',
                      :order => %w(firstname lastname id),
                      :setting_order => 1
                    },
                  :firstname_lastinitial => {
                      :string => '#{firstname} #{lastname.to_s.chars.first}.',
                      :order => %w(firstname lastname id),
                      :setting_order => 2
                    },
                  :firstinitial_lastname => {
                      :string => '#{firstname.to_s.gsub(/(([[:alpha:]])[[:alpha:]]*\.?)/, \'\2.\')} #{lastname}',
                      :order => %w(firstname lastname id),
                      :setting_order => 2
                    },
                  :firstname => {
                      :string => '#{firstname}',
                      :order => %w(firstname id),
                      :setting_order => 3
                    },
                  :lastname_firstname => {
                      :string => '#{lastname} #{firstname}',
                      :order => %w(lastname firstname id),
                      :setting_order => 4
                    },
                  :lastnamefirstname => {
                      :string => '#{lastname}#{firstname}',
                      :order => %w(lastname firstname id),
                      :setting_order => 5
                    },
                  :lastname_comma_firstname => {
                      :string => '#{lastname}, #{firstname}',
                      :order => %w(lastname firstname id),
                      :setting_order => 6
                    },
                  :lastname => {
                      :string => '#{lastname}',
                      :order => %w(lastname id),
                      :setting_order => 7
                    },
                  :username => {
                      :string => '#{login}',
                      :order => %w(login id),
                      :setting_order => 8
                    },
                }
                MAIL_NOTIFICATION_OPTIONS = [
                  ['all', :label_user_mail_option_all],
                  ['selected', :label_user_mail_option_selected],
                  ['only_my_events', :label_user_mail_option_only_my_events],
                  ['only_assigned', :label_user_mail_option_only_assigned],
                  ['only_owner', :label_user_mail_option_only_owner],
                  ['none', :label_user_mail_option_none]
                ]
                has_and_belongs_to_many :groups,
                                        :join_table   => "#{table_name_prefix}groups_users#{table_name_suffix}",
                                        :after_add    => Proc.new {|user, group| group.user_added(user)},
                                        :after_remove => Proc.new {|user, group| group.user_removed(user)}
                has_many :changesets, :dependent => :nullify
                has_one :preference, :dependent => :destroy, :class_name => 'UserPreference'
                has_one :rss_token, lambda {where "action='feeds'"}, :class_name => 'Token'
                has_one :api_token, lambda {where "action='api'"}, :class_name => 'Token'
                has_one :email_address, lambda {where :is_default => true}, :autosave => true
                has_many :email_addresses, :dependent => :delete_all
                belongs_to :auth_source
                scope :logged, lambda { where("#{User.table_name}.status <> #{STATUS_ANONYMOUS}") }
                scope :status, lambda {|arg| where(arg.blank? ? nil : {:status => arg.to_i}) }
                acts_as_customizable
                attr_accessor :password, :password_confirmation, :generate_password
                attr_accessor :last_before_login_on
                attr_accessor :remote_ip
                # Prevents unauthorized assignments
                attr_protected :password, :password_confirmation, :hashed_password
                LOGIN_LENGTH_LIMIT = 60
                MAIL_LENGTH_LIMIT = 60
                validates_presence_of :login, :firstname, :lastname, :if => Proc.new { |user| !user.is_a?(AnonymousUser) }
                validates_uniqueness_of :login, :if => Proc.new { |user| user.login_changed? && user.login.present? }, :case_sensitive => false
                # Login must contain letters, numbers, underscores only
                validates_format_of :login, :with => /\A[a-z0-9_\-@\.]*\z/i
                validates_length_of :login, :maximum => LOGIN_LENGTH_LIMIT
                validates_length_of :firstname, :lastname, :maximum => 30
+               validates_length_of :identity_url, maximum: 255
                validates_inclusion_of :mail_notification, :in => MAIL_NOTIFICATION_OPTIONS.collect(&:first), :allow_blank => true
                validate :validate_password_length
                validate do
                  if password_confirmation && password != password_confirmation
                    errors.add(:password, :confirmation)
                  end
                end
                self.valid_statuses = [STATUS_ACTIVE, STATUS_REGISTERED, STATUS_LOCKED]
                before_validation :instantiate_email_address
                before_create :set_mail_notification
                before_save   :generate_password_if_needed, :update_hashed_password
                before_destroy :remove_references_before_destroy
                after_save :update_notified_project_ids, :destroy_tokens, :deliver_security_notification
                after_destroy :deliver_security_notification
                scope :in_group, lambda {|group|
                  group_id = group.is_a?(Group) ? group.id : group.to_i
                  where("#{User.table_name}.id IN (SELECT gu.user_id FROM #{table_name_prefix}groups_users#{table_name_suffix} gu WHERE gu.group_id = ?)", group_id)
                }
                scope :not_in_group, lambda {|group|
                  group_id = group.is_a?(Group) ? group.id : group.to_i
                  where("#{User.table_name}.id NOT IN (SELECT gu.user_id FROM #{table_name_prefix}groups_users#{table_name_suffix} gu WHERE gu.group_id = ?)", group_id)
                }
                scope :sorted, lambda { order(*User.fields_for_order_statement)}
                scope :having_mail, lambda {|arg|
                  addresses = Array.wrap(arg).map {|a| a.to_s.downcase}
                  if addresses.any?
                    joins(:email_addresses).where("LOWER(#{EmailAddress.table_name}.address) IN (?)", addresses).distinct
                  else
                    none
                  end
                }
                def set_mail_notification
                  self.mail_notification = Setting.default_notification_option if self.mail_notification.blank?
                  true
                end
                def update_hashed_password
                  # update hashed_password if password was set
                  if self.password && self.auth_source_id.blank?
                    salt_password(password)
                  end
                end
                alias :base_reload :reload
                def reload(*args)
                  @name = nil
                  @projects_by_role = nil
                  @membership_by_project_id = nil
                  @notified_projects_ids = nil
                  @notified_projects_ids_changed = false
                  @builtin_role = nil
                  @visible_project_ids = nil
                  @managed_roles = nil
                  base_reload(*args)
                end
                def mail
                  email_address.try(:address)
                end
                def mail=(arg)
                  email = email_address || build_email_address
                  email.address = arg
                end
                def mail_changed?
                  email_address.try(:address_changed?)
                end
                def mails
                  email_addresses.pluck(:address)
                end
                def self.find_or_initialize_by_identity_url(url)
                  user = where(:identity_url => url).first
                  unless user
                    user = User.new
                    user.identity_url = url
                  end
                  user
                end
                def identity_url=(url)
                  if url.blank?
                    write_attribute(:identity_url, '')
                  else
                    begin
                      write_attribute(:identity_url, OpenIdAuthentication.normalize_identifier(url))
                    rescue OpenIdAuthentication::InvalidOpenId
                      # Invalid url, don't save
                    end
                  end
                  self.read_attribute(:identity_url)
                end
                # Returns the user that matches provided login and password, or nil
                def self.try_to_login(login, password, active_only=true)
                  login = login.to_s
                  password = password.to_s
                  # Make sure no one can sign in with an empty login or password
                  return nil if login.empty? || password.empty?
                  user = find_by_login(login)
                  if user
                    # user is already in local database
                    return nil unless user.check_password?(password)
                    return nil if !user.active? && active_only
                  else
                    # user is not yet registered, try to authenticate with available sources
                    attrs = AuthSource.authenticate(login, password)
                    if attrs
                      user = new(attrs)
                      user.login = login
                      user.language = Setting.default_language
                      if user.save
                        user.reload
                        logger.info("User '#{user.login}' created from external auth source: #{user.auth_source.type} - #{user.auth_source.name}") if logger && user.auth_source
                      end
                    end
                  end
                  user.update_column(:last_login_on, Time.now) if user && !user.new_record? && user.active?
                  user
                rescue => text
                  raise text
                end
                # Returns the user who matches the given autologin +key+ or nil
                def self.try_to_autologin(key)
                  user = Token.find_active_user('autologin', key, Setting.autologin.to_i)
                  if user
                    user.update_column(:last_login_on, Time.now)
                    user
                  end
                end
                def self.name_formatter(formatter = nil)
                  USER_FORMATS[formatter || Setting.user_format] || USER_FORMATS[:firstname_lastname]
                end
                # Returns an array of fields names than can be used to make an order statement for users
                # according to how user names are displayed
                # Examples:
                #
                #   User.fields_for_order_statement              => ['users.login', 'users.id']
                #   User.fields_for_order_statement('authors')   => ['authors.login', 'authors.id']
                def self.fields_for_order_statement(table=nil)
                  table ||= table_name
                  name_formatter[:order].map {|field| "#{table}.#{field}"}
                end
                # Return user's full name for display
                def name(formatter = nil)
                  f = self.class.name_formatter(formatter)
                  if formatter
                    eval('"' + f[:string] + '"')
                  else
                    @name ||= eval('"' + f[:string] + '"')
                  end
                end
                def active?
                  self.status == STATUS_ACTIVE
                end
                def registered?
                  self.status == STATUS_REGISTERED
                end
                def locked?
                  self.status == STATUS_LOCKED
                end
                def activate
                  self.status = STATUS_ACTIVE
                end
                def register
                  self.status = STATUS_REGISTERED
                end
                def lock
                  self.status = STATUS_LOCKED
                end
                def activate!
                  update_attribute(:status, STATUS_ACTIVE)
                end
                def register!
                  update_attribute(:status, STATUS_REGISTERED)
                end
                def lock!
                  update_attribute(:status, STATUS_LOCKED)
                end
                # Returns true if +clear_password+ is the correct user's password, otherwise false
                def check_password?(clear_password)
                  if auth_source_id.present?
                    auth_source.authenticate(self.login, clear_password)
                  else
                    User.hash_password("#{salt}#{User.hash_password clear_password}") == hashed_password
                  end
                end
                # Generates a random salt and computes hashed_password for +clear_password+
                # The hashed password is stored in the following form: SHA1(salt + SHA1(password))
                def salt_password(clear_password)
                  self.salt = User.generate_salt
                  self.hashed_password = User.hash_password("#{salt}#{User.hash_password clear_password}")
                  self.passwd_changed_on = Time.now.change(:usec => 0)
                end
                # Does the backend storage allow this user to change their password?
                def change_password_allowed?
                  return true if auth_source.nil?
                  return auth_source.allow_password_changes?
                end
                # Returns true if the user password has expired
                def password_expired?
                  period = Setting.password_max_age.to_i
                  if period.zero?
                    false
                  else
                    changed_on = self.passwd_changed_on || Time.at(0)
                    changed_on < period.days.ago
                  end
                end
                def must_change_password?
                  (must_change_passwd? || password_expired?) && change_password_allowed?
                end
                def generate_password?
                  generate_password == '1' || generate_password == true
                end
                # Generate and set a random password on given length
                def random_password(length=40)
                  chars = ("a".."z").to_a + ("A".."Z").to_a + ("0".."9").to_a
                  chars -= %w(0 O 1 l)
                  password = ''
                  length.times {|i| password << chars[SecureRandom.random_number(chars.size)] }
                  self.password = password
                  self.password_confirmation = password
                  self
                end
                def pref
                  self.preference ||= UserPreference.new(:user => self)
                end
                def time_zone
                  @time_zone ||= (self.pref.time_zone.blank? ? nil : ActiveSupport::TimeZone[self.pref.time_zone])
                end
                def force_default_language?
                  Setting.force_default_language_for_loggedin?
                end
                def language
                  if force_default_language?
                    Setting.default_language
                  else
                    super
                  end
                end
                def wants_comments_in_reverse_order?
                  self.pref[:comments_sorting] == 'desc'
                end
                # Return user's RSS key (a 40 chars long string), used to access feeds
                def rss_key
                  if rss_token.nil?
                    create_rss_token(:action => 'feeds')
                  end
                  rss_token.value
                end
                # Return user's API key (a 40 chars long string), used to access the API
                def api_key
                  if api_token.nil?
                    create_api_token(:action => 'api')
                  end
                  api_token.value
                end
                # Generates a new session token and returns its value
                def generate_session_token
                  token = Token.create!(:user_id => id, :action => 'session')
                  token.value
                end
                # Returns true if token is a valid session token for the user whose id is user_id
                def self.verify_session_token(user_id, token)
                  return false if user_id.blank? || token.blank?
                  scope = Token.where(:user_id => user_id, :value => token.to_s, :action => 'session')
                  if Setting.session_lifetime?
                    scope = scope.where("created_on > ?", Setting.session_lifetime.to_i.minutes.ago)
                  end
                  if Setting.session_timeout?
                    scope = scope.where("updated_on > ?", Setting.session_timeout.to_i.minutes.ago)
                  end
                  scope.update_all(:updated_on => Time.now) == 1
                end
                # Return an array of project ids for which the user has explicitly turned mail notifications on
                def notified_projects_ids
                  @notified_projects_ids ||= memberships.select {|m| m.mail_notification?}.collect(&:project_id)
                end
                def notified_project_ids=(ids)
                  @notified_projects_ids_changed = true
                  @notified_projects_ids = ids.map(&:to_i).uniq.select {|n| n > 0}
                end
                # Updates per project notifications (after_save callback)
                def update_notified_project_ids
                  if @notified_projects_ids_changed
                    ids = (mail_notification == 'selected' ? Array.wrap(notified_projects_ids).reject(&:blank?) : [])
                    members.update_all(:mail_notification => false)
                    members.where(:project_id => ids).update_all(:mail_notification => true) if ids.any?
                  end
                end
                private :update_notified_project_ids
                def valid_notification_options
                  self.class.valid_notification_options(self)
                end
                # Only users that belong to more than 1 project can select projects for which they are notified
                def self.valid_notification_options(user=nil)
                  # Note that @user.membership.size would fail since AR ignores
                  # :include association option when doing a count
                  if user.nil? || user.memberships.length < 1
                    MAIL_NOTIFICATION_OPTIONS.reject {|option| option.first == 'selected'}
                  else
                    MAIL_NOTIFICATION_OPTIONS
                  end
                end
                # Find a user account by matching the exact login and then a case-insensitive
                # version.  Exact matches will be given priority.
                def self.find_by_login(login)
                  login = Redmine::CodesetUtil.replace_invalid_utf8(login.to_s)
                  if login.present?
                    # First look for an exact match
                    user = where(:login => login).detect {|u| u.login == login}
                    unless user
                      # Fail over to case-insensitive if none was found
                      user = where("LOWER(login) = ?", login.downcase).first
                    end
                    user
                  end
                end
                def self.find_by_rss_key(key)
                  Token.find_active_user('feeds', key)
                end
                def self.find_by_api_key(key)
                  Token.find_active_user('api', key)
                end
                # Makes find_by_mail case-insensitive
                def self.find_by_mail(mail)
                  having_mail(mail).first
                end
                # Returns true if the default admin account can no longer be used
                def self.default_admin_account_changed?
                  !User.active.find_by_login("admin").try(:check_password?, "admin")
                end
                def to_s
                  name
                end
                CSS_CLASS_BY_STATUS = {
                  STATUS_ANONYMOUS  => 'anon',
                  STATUS_ACTIVE     => 'active',
                  STATUS_REGISTERED => 'registered',
                  STATUS_LOCKED     => 'locked'
                }
                def css_classes
                  "user #{CSS_CLASS_BY_STATUS[status]}"
                end
                # Returns the current day according to user's time zone
                def today
                  if time_zone.nil?
                    Date.today
                  else
                    time_zone.today
                  end
                end
                # Returns the day of +time+ according to user's time zone
                def time_to_date(time)
                  if time_zone.nil?
                    time.to_date
                  else
                    time.in_time_zone(time_zone).to_date
                  end
                end
                def logged?
                  true
                end
                def anonymous?
                  !logged?
                end
                # Returns user's membership for the given project
                # or nil if the user is not a member of project
                def membership(project)
                  project_id = project.is_a?(Project) ? project.id : project
                  @membership_by_project_id ||= Hash.new {|h, project_id|
                    h[project_id] = memberships.where(:project_id => project_id).first
                  }
                  @membership_by_project_id[project_id]
                end
                # Returns the user's bult-in role
                def builtin_role
                  @builtin_role ||= Role.non_member
                end
                # Return user's roles for project
                def roles_for_project(project)
                  # No role on archived projects
                  return [] if project.nil? || project.archived?
                  if membership = membership(project)
                    membership.roles.to_a
                  elsif project.is_public?
                    project.override_roles(builtin_role)
                  else
                    []
                  end
                end
                # Returns a hash of user's projects grouped by roles
                def projects_by_role
                  return @projects_by_role if @projects_by_role
                  hash = Hash.new([])
                  group_class = anonymous? ? GroupAnonymous : GroupNonMember
                  members = Member.joins(:project, :principal).
                    where("#{Project.table_name}.status <> 9").
                    where("#{Member.table_name}.user_id = ? OR (#{Project.table_name}.is_public = ? AND #{Principal.table_name}.type = ?)", self.id, true, group_class.name).
                    preload(:project, :roles).
                    to_a
                  members.reject! {|member| member.user_id != id && project_ids.include?(member.project_id)}
                  members.each do |member|
                    if member.project
                      member.roles.each do |role|
                        hash[role] = [] unless hash.key?(role)
                        hash[role] << member.project
                      end
                    end
                  end
                  hash.each do |role, projects|
                    projects.uniq!
                  end
                  @projects_by_role = hash
                end
                # Returns the ids of visible projects
                def visible_project_ids
                  @visible_project_ids ||= Project.visible(self).pluck(:id)
                end
                # Returns the roles that the user is allowed to manage for the given project
                def managed_roles(project)
                  if admin?
                    @managed_roles ||= Role.givable.to_a
                  else
                    membership(project).try(:managed_roles) || []
                  end
                end
                # Returns true if user is arg or belongs to arg
                def is_or_belongs_to?(arg)
                  if arg.is_a?(User)
                    self == arg
                  elsif arg.is_a?(Group)
                    arg.users.include?(self)
                  else
                    false
                  end
                end
                # Return true if the user is allowed to do the specified action on a specific context
                # Action can be:
                # * a parameter-like Hash (eg. :controller => 'projects', :action => 'edit')
                # * a permission Symbol (eg. :edit_project)
                # Context can be:
                # * a project : returns true if user is allowed to do the specified action on this project
                # * an array of projects : returns true if user is allowed on every project
                # * nil with options[:global] set : check if user has at least one role allowed for this action,
                #   or falls back to Non Member / Anonymous permissions depending if the user is logged
                def allowed_to?(action, context, options={}, &block)
                  if context && context.is_a?(Project)
                    return false unless context.allows_to?(action)
                    # Admin users are authorized for anything else
                    return true if admin?
                    roles = roles_for_project(context)
                    return false unless roles
                    roles.any? {|role|
                      (context.is_public? || role.member?) &&
                      role.allowed_to?(action) &&
                      (block_given? ? yield(role, self) : true)
                    }
                  elsif context && context.is_a?(Array)
                    if context.empty?
                      false
                    else
                      # Authorize if user is authorized on every element of the array
                      context.map {|project| allowed_to?(action, project, options, &block)}.reduce(:&)
                    end
                  elsif context
                    raise ArgumentError.new("#allowed_to? context argument must be a Project, an Array of projects or nil")
                  elsif options[:global]
                    # Admin users are always authorized
                    return true if admin?
                    # authorize if user has at least one role that has this permission
                    roles = memberships.collect {|m| m.roles}.flatten.uniq
                    roles << (self.logged? ? Role.non_member : Role.anonymous)
                    roles.any? {|role|
                      role.allowed_to?(action) &&
                      (block_given? ? yield(role, self) : true)
                    }
                  else
                    false
                  end
                end
                # Is the user allowed to do the specified action on any project?
                # See allowed_to? for the actions and valid options.
                #
                # NB: this method is not used anywhere in the core codebase as of
                # 2.5.2, but it's used by many plugins so if we ever want to remove
                # it it has to be carefully deprecated for a version or two.
                def allowed_to_globally?(action, options={}, &block)
                  allowed_to?(action, nil, options.reverse_merge(:global => true), &block)
                end
                def allowed_to_view_all_time_entries?(context)
                  allowed_to?(:view_time_entries, context) do |role, user|
                    role.time_entries_visibility == 'all'
                  end
                end
                # Returns true if the user is allowed to delete the user's own account
                def own_account_deletable?
                  Setting.unsubscribe? &&
                    (!admin? || User.active.where("admin = ? AND id <> ?", true, id).exists?)
                end
                safe_attributes 'firstname',
                  'lastname',
                  'mail',
                  'mail_notification',
                  'notified_project_ids',
                  'language',
                  'custom_field_values',
                  'custom_fields',
                  'identity_url'
                safe_attributes 'login',
                  :if => lambda {|user, current_user| user.new_record?}
                safe_attributes 'status',
                  'auth_source_id',
                  'generate_password',
                  'must_change_passwd',
                  'login',
                  'admin',
                  :if => lambda {|user, current_user| current_user.admin?}
                safe_attributes 'group_ids',
                  :if => lambda {|user, current_user| current_user.admin? && !user.new_record?}
                # Utility method to help check if a user should be notified about an
                # event.
                #
                # TODO: only supports Issue events currently
                def notify_about?(object)
                  if mail_notification == 'all'
                    true
                  elsif mail_notification.blank? || mail_notification == 'none'
                    false
                  else
                    case object
                    when Issue
                      case mail_notification
                      when 'selected', 'only_my_events'
                        # user receives notifications for created/assigned issues on unselected projects
                        object.author == self || is_or_belongs_to?(object.assigned_to) || is_or_belongs_to?(object.assigned_to_was)
                      when 'only_assigned'
                        is_or_belongs_to?(object.assigned_to) || is_or_belongs_to?(object.assigned_to_was)
                      when 'only_owner'
                        object.author == self
                      end
                    when News
                      # always send to project members except when mail_notification is set to 'none'
                      true
                    end
                  end
                end
                def self.current=(user)
                  RequestStore.store[:current_user] = user
                end
                def self.current
                  RequestStore.store[:current_user] ||= User.anonymous
                end
                # Returns the anonymous user.  If the anonymous user does not exist, it is created.  There can be only
                # one anonymous user per database.
                def self.anonymous
                  anonymous_user = AnonymousUser.first
                  if anonymous_user.nil?
                    anonymous_user = AnonymousUser.create(:lastname => 'Anonymous', :firstname => '', :login => '', :status => 0)
                    raise 'Unable to create the anonymous user.' if anonymous_user.new_record?
                  end
                  anonymous_user
                end
                # Salts all existing unsalted passwords
                # It changes password storage scheme from SHA1(password) to SHA1(salt + SHA1(password))
                # This method is used in the SaltPasswords migration and is to be kept as is
                def self.salt_unsalted_passwords!
                  transaction do
                    User.where("salt IS NULL OR salt = ''").find_each do |user|
                      next if user.hashed_password.blank?
                      salt = User.generate_salt
                      hashed_password = User.hash_password("#{salt}#{user.hashed_password}")
                      User.where(:id => user.id).update_all(:salt => salt, :hashed_password => hashed_password)
                    end
                  end
                end
                protected
                def validate_password_length
                  return if password.blank? && generate_password?
                  # Password length validation based on setting
                  if !password.nil? && password.size < Setting.password_min_length.to_i
                    errors.add(:password, :too_short, :count => Setting.password_min_length.to_i)
                  end
                end
                def instantiate_email_address
                  email_address || build_email_address
                end
                private
                def generate_password_if_needed
                  if generate_password? && auth_source.nil?
                    length = [Setting.password_min_length.to_i + 2, 10].max
                    random_password(length)
                  end
                end
                # Delete all outstanding password reset tokens on password change.
                # Delete the autologin tokens on password change to prohibit session leakage.
                # This helps to keep the account secure in case the associated email account
                # was compromised.
                def destroy_tokens
                  if hashed_password_changed? || (status_changed? && !active?)
                    tokens = ['recovery', 'autologin', 'session']
                    Token.where(:user_id => id, :action => tokens).delete_all
                  end
                end
                # Removes references that are not handled by associations
                # Things that are not deleted are reassociated with the anonymous user
                def remove_references_before_destroy
                  return if self.id.nil?
                  substitute = User.anonymous
                  Attachment.where(['author_id = ?', id]).update_all(['author_id = ?', substitute.id])
                  Comment.where(['author_id = ?', id]).update_all(['author_id = ?', substitute.id])
                  Issue.where(['author_id = ?', id]).update_all(['author_id = ?', substitute.id])
                  Issue.where(['assigned_to_id = ?', id]).update_all('assigned_to_id = NULL')
                  Journal.where(['user_id = ?', id]).update_all(['user_id = ?', substitute.id])
                  JournalDetail.
                    where(["property = 'attr' AND prop_key = 'assigned_to_id' AND old_value = ?", id.to_s]).
                    update_all(['old_value = ?', substitute.id.to_s])
                  JournalDetail.
                    where(["property = 'attr' AND prop_key = 'assigned_to_id' AND value = ?", id.to_s]).
                    update_all(['value = ?', substitute.id.to_s])
                  Message.where(['author_id = ?', id]).update_all(['author_id = ?', substitute.id])
                  News.where(['author_id = ?', id]).update_all(['author_id = ?', substitute.id])
                  # Remove private queries and keep public ones
                  ::Query.where('user_id = ? AND visibility = ?', id, ::Query::VISIBILITY_PRIVATE).delete_all
                  ::Query.where(['user_id = ?', id]).update_all(['user_id = ?', substitute.id])
                  TimeEntry.where(['user_id = ?', id]).update_all(['user_id = ?', substitute.id])
                  Token.where('user_id = ?', id).delete_all
                  Watcher.where('user_id = ?', id).delete_all
                  WikiContent.where(['author_id = ?', id]).update_all(['author_id = ?', substitute.id])
                  WikiContent::Version.where(['author_id = ?', id]).update_all(['author_id = ?', substitute.id])
                end
                # Return password digest
                def self.hash_password(clear_password)
                  Digest::SHA1.hexdigest(clear_password || "")
                end
                # Returns a 128bits random salt as a hex string (32 chars long)
                def self.generate_salt
                  Redmine::Utils.random_hex(16)
                end
                # Send a security notification to all admins if the user has gained/lost admin privileges
                def deliver_security_notification
                  options = {
                    field: :field_admin,
                    value: login,
                    title: :label_user_plural,
                    url: {controller: 'users', action: 'index'}
                  }
                  deliver = false
                  if (admin? && id_changed? && active?) ||    # newly created admin
                     (admin? && admin_changed? && active?) || # regular user became admin
                     (admin? && status_changed? && active?)   # locked admin became active again
                     deliver = true
                     options[:message] = :mail_body_security_notification_add
                  elsif (admin? && destroyed? && active?) ||      # active admin user was deleted
                        (!admin? && admin_changed? && active?) || # admin is no longer admin
                        (admin? && status_changed? && !active?)   # admin was locked
                        deliver = true
                        options[:message] = :mail_body_security_notification_remove
                  end
                  if deliver
                    users = User.active.where(admin: true).to_a
                    Mailer.security_notification(users, options).deliver
                  end
                end
              end
              class AnonymousUser < User
                validate :validate_anonymous_uniqueness, :on => :create
                self.valid_statuses = [STATUS_ANONYMOUS]
                def validate_anonymous_uniqueness
                  # There should be only one AnonymousUser in the database
                  errors.add :base, 'An anonymous user already exists.' if AnonymousUser.exists?
                end
                def available_custom_fields
                  []
                end
                # Overrides a few properties
                def logged?; false end
                def admin; false end
                def name(*args); I18n.t(:label_user_anonymous) end
                def mail=(*args); nil end
                def mail; nil end
                def time_zone; nil end
                def rss_key; nil end
                def pref
                  UserPreference.new(:user => self)
                end
                # Returns the user's bult-in role
                def builtin_role
                  @builtin_role ||= Role.anonymous
                end
                def membership(*args)
                  nil
                end
                def member_of?(*args)
                  false
                end
                # Anonymous user can not be destroyed
                def destroy
                  false
                end
                protected
                def instantiate_email_address
                end
              end

app/models/version.rb +1 -1

              # Redmine - project management software
              # Copyright (C) 2006-2016  Jean-Philippe Lang
              #
              # This program is free software; you can redistribute it and/or
              # modify it under the terms of the GNU General Public License
              # as published by the Free Software Foundation; either version 2
              # of the License, or (at your option) any later version.
              #
              # This program is distributed in the hope that it will be useful,
              # but WITHOUT ANY WARRANTY; without even the implied warranty of
              # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
              # GNU General Public License for more details.
              #
              # You should have received a copy of the GNU General Public License
              # along with this program; if not, write to the Free Software
              # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
              class Version < ActiveRecord::Base
                include Redmine::SafeAttributes
                after_update :update_issues_from_sharing_change
                after_save :update_default_project_version
                before_destroy :nullify_projects_default_version
                belongs_to :project
                has_many :fixed_issues, :class_name => 'Issue', :foreign_key => 'fixed_version_id', :dependent => :nullify
                acts_as_customizable
                acts_as_attachable :view_permission => :view_files,
                                   :edit_permission => :manage_files,
                                   :delete_permission => :manage_files
                VERSION_STATUSES = %w(open locked closed)
                VERSION_SHARINGS = %w(none descendants hierarchy tree system)
                validates_presence_of :name
                validates_uniqueness_of :name, :scope => [:project_id]
                validates_length_of :name, :maximum => 60
-               validates_length_of :description, :maximum => 255
+               validates_length_of :description, :wiki_page_title, :maximum => 255
                validates :effective_date, :date => true
                validates_inclusion_of :status, :in => VERSION_STATUSES
                validates_inclusion_of :sharing, :in => VERSION_SHARINGS
                attr_protected :id
                scope :named, lambda {|arg| where("LOWER(#{table_name}.name) = LOWER(?)", arg.to_s.strip)}
                scope :like, lambda {|arg|
                  if arg.present?
                    pattern = "%#{arg.to_s.strip}%"
                    where("LOWER(#{Version.table_name}.name) LIKE :p", :p => pattern)
                  end
                }
                scope :open, lambda { where(:status => 'open') }
                scope :status, lambda {|status|
                  if status.present?
                    where(:status => status.to_s)
                  end
                }
                scope :visible, lambda {|*args|
                  joins(:project).
                  where(Project.allowed_to_condition(args.first || User.current, :view_issues))
                }
                safe_attributes 'name',
                  'description',
                  'effective_date',
                  'due_date',
                  'wiki_page_title',
                  'status',
                  'sharing',
                  'default_project_version',
                  'custom_field_values',
                  'custom_fields'
                # Returns true if +user+ or current user is allowed to view the version
                def visible?(user=User.current)
                  user.allowed_to?(:view_issues, self.project)
                end
                # Version files have same visibility as project files
                def attachments_visible?(*args)
                  project.present? && project.attachments_visible?(*args)
                end
                def attachments_deletable?(usr=User.current)
                  project.present? && project.attachments_deletable?(usr)
                end
                alias :base_reload :reload
                def reload(*args)
                  @default_project_version = nil
                  base_reload(*args)
                end
                def start_date
                  @start_date ||= fixed_issues.minimum('start_date')
                end
                def due_date
                  effective_date
                end
                def due_date=(arg)
                  self.effective_date=(arg)
                end
                # Returns the total estimated time for this version
                # (sum of leaves estimated_hours)
                def estimated_hours
                  @estimated_hours ||= fixed_issues.sum(:estimated_hours).to_f
                end
                # Returns the total reported time for this version
                def spent_hours
                  @spent_hours ||= TimeEntry.joins(:issue).where("#{Issue.table_name}.fixed_version_id = ?", id).sum(:hours).to_f
                end
                def closed?
                  status == 'closed'
                end
                def open?
                  status == 'open'
                end
                # Returns true if the version is completed: closed or due date reached and no open issues
                def completed?
                  closed? || (effective_date && (effective_date < User.current.today) && (open_issues_count == 0))
                end
                def behind_schedule?
                  if completed_percent == 100
                    return false
                  elsif due_date && start_date
                    done_date = start_date + ((due_date - start_date+1)* completed_percent/100).floor
                    return done_date <= User.current.today
                  else
                    false # No issues so it's not late
                  end
                end
                # Returns the completion percentage of this version based on the amount of open/closed issues
                # and the time spent on the open issues.
                def completed_percent
                  if issues_count == 0
 
                  elsif open_issues_count == 0
 
                  else
                    issues_progress(false) + issues_progress(true)
                  end
                end
                # Returns the percentage of issues that have been marked as 'closed'.
                def closed_percent
                  if issues_count == 0
 
                  else
                    issues_progress(false)
                  end
                end
                # Returns true if the version is overdue: due date reached and some open issues
                def overdue?
                  effective_date && (effective_date < User.current.today) && (open_issues_count > 0)
                end
                # Returns assigned issues count
                def issues_count
                  load_issue_counts
                  @issue_count
                end
                # Returns the total amount of open issues for this version.
                def open_issues_count
                  load_issue_counts
                  @open_issues_count
                end
                # Returns the total amount of closed issues for this version.
                def closed_issues_count
                  load_issue_counts
                  @closed_issues_count
                end
                def wiki_page
                  if project.wiki && !wiki_page_title.blank?
                    @wiki_page ||= project.wiki.find_page(wiki_page_title)
                  end
                  @wiki_page
                end
                def to_s; name end
                def to_s_with_project
                  "#{project} - #{name}"
                end
                # Versions are sorted by effective_date and name
                # Those with no effective_date are at the end, sorted by name
                def <=>(version)
                  if self.effective_date
                    if version.effective_date
                      if self.effective_date == version.effective_date
                        name == version.name ? id <=> version.id : name <=> version.name
                      else
                        self.effective_date <=> version.effective_date
                      end
                    else
                      -1
                    end
                  else
                    if version.effective_date
 
                    else
                      name == version.name ? id <=> version.id : name <=> version.name
                    end
                  end
                end
                # Sort versions by status (open, locked then closed versions)
                def self.sort_by_status(versions)
                  versions.sort do |a, b|
                    if a.status == b.status
                      a <=> b
                    else
                      b.status <=> a.status
                    end
                  end
                end
                def css_classes
                  [
                    completed? ? 'version-completed' : 'version-incompleted',
                    "version-#{status}"
                  ].join(' ')
                end
                def self.fields_for_order_statement(table=nil)
                  table ||= table_name
                  ["(CASE WHEN #{table}.effective_date IS NULL THEN 1 ELSE 0 END)", "#{table}.effective_date", "#{table}.name", "#{table}.id"]
                end
                scope :sorted, lambda { order(fields_for_order_statement) }
                # Returns the sharings that +user+ can set the version to
                def allowed_sharings(user = User.current)
                  VERSION_SHARINGS.select do |s|
                    if sharing == s
                      true
                    else
                      case s
                      when 'system'
                        # Only admin users can set a systemwide sharing
                        user.admin?
                      when 'hierarchy', 'tree'
                        # Only users allowed to manage versions of the root project can
                        # set sharing to hierarchy or tree
                        project.nil? || user.allowed_to?(:manage_versions, project.root)
                      else
                        true
                      end
                    end
                  end
                end
                # Returns true if the version is shared, otherwise false
                def shared?
                  sharing != 'none'
                end
                def deletable?
                  fixed_issues.empty? && !referenced_by_a_custom_field?
                end
                def default_project_version
                  if @default_project_version.nil?
                    project.present? && project.default_version == self
                  else
                    @default_project_version
                  end
                end
                def default_project_version=(arg)
                  @default_project_version = (arg == '1' || arg == true)
                end
                private
                def load_issue_counts
                  unless @issue_count
                    @open_issues_count = 0
                    @closed_issues_count = 0
                    fixed_issues.group(:status).count.each do |status, count|
                      if status.is_closed?
                        @closed_issues_count += count
                      else
                        @open_issues_count += count
                      end
                    end
                    @issue_count = @open_issues_count + @closed_issues_count
                  end
                end
                # Update the issue's fixed versions. Used if a version's sharing changes.
                def update_issues_from_sharing_change
                  if sharing_changed?
                    if VERSION_SHARINGS.index(sharing_was).nil? ||
                        VERSION_SHARINGS.index(sharing).nil? ||
                        VERSION_SHARINGS.index(sharing_was) > VERSION_SHARINGS.index(sharing)
                      Issue.update_versions_from_sharing_change self
                    end
                  end
                end
                def update_default_project_version
                  if @default_project_version && project.present?
                    project.update_columns :default_version_id => id
                  end
                end
                # Returns the average estimated time of assigned issues
                # or 1 if no issue has an estimated time
                # Used to weight unestimated issues in progress calculation
                def estimated_average
                  if @estimated_average.nil?
                    average = fixed_issues.average(:estimated_hours).to_f
                    if average == 0
                      average = 1
                    end
                    @estimated_average = average
                  end
                  @estimated_average
                end
                # Returns the total progress of open or closed issues.  The returned percentage takes into account
                # the amount of estimated time set for this version.
                #
                # Examples:
                # issues_progress(true)   => returns the progress percentage for open issues.
                # issues_progress(false)  => returns the progress percentage for closed issues.
                def issues_progress(open)
                  @issues_progress ||= {}
                  @issues_progress[open] ||= begin
                    progress = 0
                    if issues_count > 0
                      ratio = open ? 'done_ratio' : 100
                      done = fixed_issues.open(open).sum("COALESCE(estimated_hours, #{estimated_average}) * #{ratio}").to_f
                      progress = done / (estimated_average * issues_count)
                    end
                    progress
                  end
                end
                def referenced_by_a_custom_field?
                  CustomValue.joins(:custom_field).
                    where(:value => id.to_s, :custom_fields => {:field_format => 'version'}).any?
                end
                def nullify_projects_default_version
                  Project.where(:default_version_id => id).update_all(:default_version_id => nil)
                end
              end

app/models/wiki.rb +1 0

              # Redmine - project management software
              # Copyright (C) 2006-2016  Jean-Philippe Lang
              #
              # This program is free software; you can redistribute it and/or
              # modify it under the terms of the GNU General Public License
              # as published by the Free Software Foundation; either version 2
              # of the License, or (at your option) any later version.
              #
              # This program is distributed in the hope that it will be useful,
              # but WITHOUT ANY WARRANTY; without even the implied warranty of
              # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
              # GNU General Public License for more details.
              #
              # You should have received a copy of the GNU General Public License
              # along with this program; if not, write to the Free Software
              # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
              class Wiki < ActiveRecord::Base
                include Redmine::SafeAttributes
                belongs_to :project
                has_many :pages, lambda {order('title')}, :class_name => 'WikiPage', :dependent => :destroy
                has_many :redirects, :class_name => 'WikiRedirect'
                acts_as_watchable
                validates_presence_of :start_page
                validates_format_of :start_page, :with => /\A[^,\.\/\?\;\|\:]*\z/
+               validates_length_of :title, maximum: 255
                attr_protected :id
                before_destroy :delete_redirects
                safe_attributes 'start_page'
                def visible?(user=User.current)
                  !user.nil? && user.allowed_to?(:view_wiki_pages, project)
                end
                # Returns the wiki page that acts as the sidebar content
                # or nil if no such page exists
                def sidebar
                  @sidebar ||= find_page('Sidebar', :with_redirect => false)
                end
                # find the page with the given title
                # if page doesn't exist, return a new page
                def find_or_new_page(title)
                  title = start_page if title.blank?
                  find_page(title) || WikiPage.new(:wiki => self, :title => Wiki.titleize(title))
                end
                # find the page with the given title
                def find_page(title, options = {})
                  @page_found_with_redirect = false
                  title = start_page if title.blank?
                  title = Wiki.titleize(title)
                  page = pages.where("LOWER(title) = LOWER(?)", title).first
                  if page.nil? && options[:with_redirect] != false
                    # search for a redirect
                    redirect = redirects.where("LOWER(title) = LOWER(?)", title).first
                    if redirect
                      page = redirect.target_page
                      @page_found_with_redirect = true
                    end
                  end
                  page
                end
                # Returns true if the last page was found with a redirect
                def page_found_with_redirect?
                  @page_found_with_redirect
                end
                # Deletes all redirects from/to the wiki
                def delete_redirects
                  WikiRedirect.where(:wiki_id => id).delete_all
                  WikiRedirect.where(:redirects_to_wiki_id => id).delete_all
                end
                # Finds a page by title
                # The given string can be of one of the forms: "title" or "project:title"
                # Examples:
                #   Wiki.find_page("bar", project => foo)
                #   Wiki.find_page("foo:bar")
                def self.find_page(title, options = {})
                  project = options[:project]
                  if title.to_s =~ %r{^([^\:]+)\:(.*)$}
                    project_identifier, title = $1, $2
                    project = Project.find_by_identifier(project_identifier) || Project.find_by_name(project_identifier)
                  end
                  if project && project.wiki
                    page = project.wiki.find_page(title)
                    if page && page.content
                      page
                    end
                  end
                end
                # turn a string into a valid page title
                def self.titleize(title)
                  # replace spaces with _ and remove unwanted caracters
                  title = title.gsub(/\s+/, '_').delete(',./?;|:') if title
                  # upcase the first letter
                  title = (title.slice(0..0).upcase + (title.slice(1..-1) || '')) if title
                  title
                end
              end

app/models/wiki_page.rb +1 0

              # Redmine - project management software
              # Copyright (C) 2006-2016  Jean-Philippe Lang
              #
              # This program is free software; you can redistribute it and/or
              # modify it under the terms of the GNU General Public License
              # as published by the Free Software Foundation; either version 2
              # of the License, or (at your option) any later version.
              #
              # This program is distributed in the hope that it will be useful,
              # but WITHOUT ANY WARRANTY; without even the implied warranty of
              # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
              # GNU General Public License for more details.
              #
              # You should have received a copy of the GNU General Public License
              # along with this program; if not, write to the Free Software
              # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
              require 'diff'
              require 'enumerator'
              class WikiPage < ActiveRecord::Base
                include Redmine::SafeAttributes
                belongs_to :wiki
                has_one :content, :class_name => 'WikiContent', :foreign_key => 'page_id', :dependent => :destroy
                has_one :content_without_text, lambda {without_text.readonly}, :class_name => 'WikiContent', :foreign_key => 'page_id'
                acts_as_attachable :delete_permission => :delete_wiki_pages_attachments
                acts_as_tree :dependent => :nullify, :order => 'title'
                acts_as_watchable
                acts_as_event :title => Proc.new {|o| "#{l(:label_wiki)}: #{o.title}"},
                              :description => :text,
                              :datetime => :created_on,
                              :url => Proc.new {|o| {:controller => 'wiki', :action => 'show', :project_id => o.wiki.project, :id => o.title}}
                acts_as_searchable :columns => ['title', "#{WikiContent.table_name}.text"],
                                   :scope => joins(:content, {:wiki => :project}),
                                   :preload => [:content, {:wiki => :project}],
                                   :permission => :view_wiki_pages,
                                   :project_key => "#{Wiki.table_name}.project_id"
                attr_accessor :redirect_existing_links
                validates_presence_of :title
                validates_format_of :title, :with => /\A[^,\.\/\?\;\|\s]*\z/
                validates_uniqueness_of :title, :scope => :wiki_id, :case_sensitive => false
+               validates_length_of :title, maximum: 255
                validates_associated :content
                attr_protected :id
                validate :validate_parent_title
                before_destroy :delete_redirects
                before_save :handle_rename_or_move
                after_save :handle_children_move
                # eager load information about last updates, without loading text
                scope :with_updated_on, lambda { preload(:content_without_text) }
                # Wiki pages that are protected by default
                DEFAULT_PROTECTED_PAGES = %w(sidebar)
                safe_attributes 'parent_id', 'parent_title', 'title', 'redirect_existing_links', 'wiki_id',
                  :if => lambda {|page, user| page.new_record? || user.allowed_to?(:rename_wiki_pages, page.project)}
                def initialize(attributes=nil, *args)
                  super
                  if new_record? && DEFAULT_PROTECTED_PAGES.include?(title.to_s.downcase)
                    self.protected = true
                  end
                end
                def visible?(user=User.current)
                  !user.nil? && user.allowed_to?(:view_wiki_pages, project)
                end
                def title=(value)
                  value = Wiki.titleize(value)
                  write_attribute(:title, value)
                end
                def safe_attributes=(attrs, user=User.current)
                  return unless attrs.is_a?(Hash)
                  attrs = attrs.deep_dup
                  # Project and Tracker must be set before since new_statuses_allowed_to depends on it.
                  if (w_id = attrs.delete('wiki_id')) && safe_attribute?('wiki_id')
                    if (w = Wiki.find_by_id(w_id)) && w.project && user.allowed_to?(:rename_wiki_pages, w.project)
                      self.wiki = w
                    end
                  end
                  super attrs, user
                end
                # Manages redirects if page is renamed or moved
                def handle_rename_or_move
                  if !new_record? && (title_changed? || wiki_id_changed?)
                    # Update redirects that point to the old title
                    WikiRedirect.where(:redirects_to => title_was, :redirects_to_wiki_id => wiki_id_was).each do |r|
                      r.redirects_to = title
                      r.redirects_to_wiki_id = wiki_id
                      (r.title == r.redirects_to && r.wiki_id == r.redirects_to_wiki_id) ? r.destroy : r.save
                    end
                    # Remove redirects for the new title
                    WikiRedirect.where(:wiki_id => wiki_id, :title => title).delete_all
                    # Create a redirect to the new title
                    unless redirect_existing_links == "0"
                      WikiRedirect.create(
                        :wiki_id => wiki_id_was, :title => title_was,
                        :redirects_to_wiki_id => wiki_id, :redirects_to => title
                      )
                    end
                  end
                  if !new_record? && wiki_id_changed? && parent.present?
                    unless parent.wiki_id == wiki_id
                      self.parent_id = nil
                    end
                  end
                end
                private :handle_rename_or_move
                # Moves child pages if page was moved
                def handle_children_move
                  if !new_record? && wiki_id_changed?
                    children.each do |child|
                      child.wiki_id = wiki_id
                      child.redirect_existing_links = redirect_existing_links
                      unless child.save
                        WikiPage.where(:id => child.id).update_all :parent_id => nil
                      end
                    end
                  end
                end
                private :handle_children_move
                # Deletes redirects to this page
                def delete_redirects
                  WikiRedirect.where(:redirects_to_wiki_id => wiki_id, :redirects_to => title).delete_all
                end
                def pretty_title
                  WikiPage.pretty_title(title)
                end
                def content_for_version(version=nil)
                  if content
                    result = content.versions.find_by_version(version.to_i) if version
                    result ||= content
                    result
                  end
                end
                def diff(version_to=nil, version_from=nil)
                  version_to = version_to ? version_to.to_i : self.content.version
                  content_to = content.versions.find_by_version(version_to)
                  content_from = version_from ? content.versions.find_by_version(version_from.to_i) : content_to.try(:previous)
                  return nil unless content_to && content_from
                  if content_from.version > content_to.version
                    content_to, content_from = content_from, content_to
                  end
                  (content_to && content_from) ? WikiDiff.new(content_to, content_from) : nil
                end
                def annotate(version=nil)
                  version = version ? version.to_i : self.content.version
                  c = content.versions.find_by_version(version)
                  c ? WikiAnnotate.new(c) : nil
                end
                def self.pretty_title(str)
                  (str && str.is_a?(String)) ? str.tr('_', ' ') : str
                end
                def project
                  wiki.try(:project)
                end
                def text
                  content.text if content
                end
                def updated_on
                  content_attribute(:updated_on)
                end
                def version
                  content_attribute(:version)
                end
                # Returns true if usr is allowed to edit the page, otherwise false
                def editable_by?(usr)
                  !protected? || usr.allowed_to?(:protect_wiki_pages, wiki.project)
                end
                def attachments_deletable?(usr=User.current)
                  editable_by?(usr) && super(usr)
                end
                def parent_title
                  @parent_title || (self.parent && self.parent.pretty_title)
                end
                def parent_title=(t)
                  @parent_title = t
                  parent_page = t.blank? ? nil : self.wiki.find_page(t)
                  self.parent = parent_page
                end
                # Saves the page and its content if text was changed
                # Return true if the page was saved
                def save_with_content(content)
                  ret = nil
                  transaction do
                    ret = save
                    if content.text_changed?
                      begin
                        self.content = content
                        ret = ret && content.changed?
                      rescue ActiveRecord::RecordNotSaved
                        ret = false
                      end
                    end
                    raise ActiveRecord::Rollback unless ret
                  end
                  ret
                end
                protected
                def validate_parent_title
                  errors.add(:parent_title, :invalid) if !@parent_title.blank? && parent.nil?
                  errors.add(:parent_title, :circular_dependency) if parent && (parent == self || parent.ancestors.include?(self))
                  if parent_id_changed? && parent && (parent.wiki_id != wiki_id)
                    errors.add(:parent_title, :not_same_project)
                  end
                end
                private
                def content_attribute(name)
                  (association(:content).loaded? ? content : content_without_text).try(name)
                end
              end
              class WikiDiff < Redmine::Helpers::Diff
                attr_reader :content_to, :content_from
                def initialize(content_to, content_from)
                  @content_to = content_to
                  @content_from = content_from
                  super(content_to.text, content_from.text)
                end
              end
              class WikiAnnotate
                attr_reader :lines, :content
                def initialize(content)
                  @content = content
                  current = content
                  current_lines = current.text.split(/\r?\n/)
                  @lines = current_lines.collect {|t| [nil, nil, t]}
                  positions = []
                  current_lines.size.times {|i| positions << i}
                  while (current.previous)
                    d = current.previous.text.split(/\r?\n/).diff(current.text.split(/\r?\n/)).diffs.flatten
                    d.each_slice(3) do |s|
                      sign, line = s[0], s[1]
                      if sign == '+' && positions[line] && positions[line] != -1
                        if @lines[positions[line]][0].nil?
                          @lines[positions[line]][0] = current.version
                          @lines[positions[line]][1] = current.author
                        end
                      end
                    end
                    d.each_slice(3) do |s|
                      sign, line = s[0], s[1]
                      if sign == '-'
                        positions.insert(line, -1)
                      else
                        positions[line] = nil
                      end
                    end
                    positions.compact!
                    # Stop if every line is annotated
                    break unless @lines.detect { |line| line[0].nil? }
                    current = current.previous
                  end
                  @lines.each { |line|
                    line[0] ||= current.version
                    # if the last known version is > 1 (eg. history was cleared), we don't know the author
                    line[1] ||= current.author if current.version == 1
                  }
                end
              end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages