jro_apps/redmine Commit - r13730:ed2a3a224498

Make sure that settings are unserialized as UTF-8 encoded strings (#19305)....

Jean-Philippe Lang -

r13730:ed2a3a224498

parent child

Context file:

r13730:ed2a3a224498

Collapse all files

app/models/setting.rb +23 -1

             # Redmine - project management software
             # Copyright (C) 2006-2015  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class Setting < ActiveRecord::Base
               DATE_FORMATS = [
                     '%Y-%m-%d',
                     '%d/%m/%Y',
                     '%d.%m.%Y',
                     '%d-%m-%Y',
                     '%m/%d/%Y',
                     '%d %b %Y',
                     '%d %B %Y',
                     '%b %d, %Y',
                     '%B %d, %Y'
                 ]
               TIME_FORMATS = [
                 '%H:%M',
                 '%I:%M %p'
                 ]
               ENCODINGS = %w(US-ASCII
                               windows-1250
                               windows-1251
                               windows-1252
                               windows-1253
                               windows-1254
                               windows-1255
                               windows-1256
                               windows-1257
                               windows-1258
                               windows-31j
                               ISO-2022-JP
                               ISO-2022-KR
                               ISO-8859-1
                               ISO-8859-2
                               ISO-8859-3
                               ISO-8859-4
                               ISO-8859-5
                               ISO-8859-6
                               ISO-8859-7
                               ISO-8859-8
                               ISO-8859-9
                               ISO-8859-13
                               ISO-8859-15
                               KOI8-R
                               UTF-8
                               UTF-16
                               UTF-16BE
                               UTF-16LE
                               EUC-JP
                               Shift_JIS
                               CP932
                               GB18030
                               GBK
                               ISCII91
                               EUC-KR
                               Big5
                               Big5-HKSCS
                               TIS-620)
               cattr_accessor :available_settings
               self.available_settings ||= {}
               validates_uniqueness_of :name, :if => Proc.new {|setting| setting.new_record? || setting.name_changed?}
               validates_inclusion_of :name, :in => Proc.new {available_settings.keys}
               validates_numericality_of :value, :only_integer => true, :if => Proc.new { |setting|
                 (s = available_settings[setting.name]) && s['format'] == 'int'
               }
               attr_protected :id
               # Hash used to cache setting values
               @cached_settings = {}
               @cached_cleared_on = Time.now
               def value
                 v = read_attribute(:value)
                 # Unserialize serialized settings
-                v = YAML::load(v) if available_settings[name]['serialized'] && v.is_a?(String)
+                if available_settings[name]['serialized'] && v.is_a?(String)
+                  v = YAML::load(v)
+                  v = force_utf8_strings(v)
+                end
                 v = v.to_sym if available_settings[name]['format'] == 'symbol' && !v.blank?
                 v
               end
               def value=(v)
                 v = v.to_yaml if v && available_settings[name] && available_settings[name]['serialized']
                 write_attribute(:value, v.to_s)
               end
               # Returns the value of the setting named name
               def self.[](name)
                 v = @cached_settings[name]
                 v ? v : (@cached_settings[name] = find_or_default(name).value)
               end
               def self.[]=(name, v)
                 setting = find_or_default(name)
                 setting.value = (v ? v : "")
                 @cached_settings[name] = nil
                 setting.save
                 setting.value
               end
               # Sets a setting value from params
               def self.set_from_params(name, params)
                 params = params.dup
                 params.delete_if {|v| v.blank? } if params.is_a?(Array)
                 params.symbolize_keys! if params.is_a?(Hash)
                 m = "#{name}_from_params"
                 if respond_to? m
                   self[name.to_sym] = send m, params
                 else
                   self[name.to_sym] = params
                 end
               end
               # Returns a hash suitable for commit_update_keywords setting
               #
               # Example:
               # params = {:keywords => ['fixes', 'closes'], :status_id => ["3", "5"], :done_ratio => ["", "100"]}
               # Setting.commit_update_keywords_from_params(params)
               # # => [{'keywords => 'fixes', 'status_id' => "3"}, {'keywords => 'closes', 'status_id' => "5", 'done_ratio' => "100"}]
               def self.commit_update_keywords_from_params(params)
                 s = []
                 if params.is_a?(Hash) && params.key?(:keywords) && params.values.all? {|v| v.is_a? Array}
                   attributes = params.except(:keywords).keys
                   params[:keywords].each_with_index do |keywords, i|
                     next if keywords.blank?
                     s << attributes.inject({}) {|h, a|
                       value = params[a][i].to_s
                       h[a.to_s] = value if value.present?
                       h
                     }.merge('keywords' => keywords)
                   end
                 end
                 s
               end
               # Helper that returns an array based on per_page_options setting
               def self.per_page_options_array
                 per_page_options.split(%r{[\s,]}).collect(&:to_i).select {|n| n > 0}.sort
               end
               # Helper that returns a Hash with single update keywords as keys
               def self.commit_update_keywords_array
                 a = []
                 if commit_update_keywords.is_a?(Array)
                   commit_update_keywords.each do |rule|
                     next unless rule.is_a?(Hash)
                     rule = rule.dup
                     rule.delete_if {|k, v| v.blank?}
                     keywords = rule['keywords'].to_s.downcase.split(",").map(&:strip).reject(&:blank?)
                     next if keywords.empty?
                     a << rule.merge('keywords' => keywords)
                   end
                 end
                 a
               end
               def self.openid?
                 Object.const_defined?(:OpenID) && self[:openid].to_i > 0
               end
               # Checks if settings have changed since the values were read
               # and clears the cache hash if it's the case
               # Called once per request
               def self.check_cache
                 settings_updated_on = Setting.maximum(:updated_on)
                 if settings_updated_on && @cached_cleared_on <= settings_updated_on
                   clear_cache
                 end
               end
               # Clears the settings cache
               def self.clear_cache
                 @cached_settings.clear
                 @cached_cleared_on = Time.now
                 logger.info "Settings cache cleared." if logger
               end
               def self.define_plugin_setting(plugin)
                 if plugin.settings
                   name = "plugin_#{plugin.id}"
                   define_setting name, {'default' => plugin.settings[:default], 'serialized' => true}
                 end
               end
               # Defines getter and setter for each setting
               # Then setting values can be read using: Setting.some_setting_name
               # or set using Setting.some_setting_name = "some value"
               def self.define_setting(name, options={})
                 available_settings[name.to_s] = options
                 src = <<-END_SRC
                 def self.#{name}
                   self[:#{name}]
                 end
                 def self.#{name}?
                   self[:#{name}].to_i > 0
                 end
                 def self.#{name}=(value)
                   self[:#{name}] = value
                 end
             END_SRC
                 class_eval src, __FILE__, __LINE__
               end
               def self.load_available_settings
                 YAML::load(File.open("#{Rails.root}/config/settings.yml")).each do |name, options|
                   define_setting name, options
                 end
               end
               def self.load_plugin_settings
                 Redmine::Plugin.all.each do |plugin|
                   define_plugin_setting(plugin)
                 end
               end
               load_available_settings
               load_plugin_settings
             private
+              def force_utf8_strings(arg)
+                if arg.is_a?(String)
+                  arg.dup.force_encoding('UTF-8')
+                elsif arg.is_a?(Array)
+                  arg.map do |a|
+                    force_utf8_strings(a)
+                  end
+                elsif arg.is_a?(Hash)
+                  arg = arg.dup
+                  arg.each do |k,v|
+                    arg[k] = force_utf8_strings(v)
+                  end
+                  arg
+                else
+                  arg
+                end
+              end
               # Returns the Setting instance for the setting named name
               # (record found in database or new record with default value)
               def self.find_or_default(name)
                 name = name.to_s
                 raise "There's no setting named #{name}" unless available_settings.has_key?(name)
                 setting = where(:name => name).order(:id => :desc).first
                 unless setting
                   setting = new
                   setting.name = name
                   setting.value = available_settings[name]['default']
                 end
                 setting
               end
             end

test/unit/setting_test.rb +23 0

+            # encoding: utf-8
+            #
             # Redmine - project management software
             # Copyright (C) 2006-2015  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require File.expand_path('../../test_helper', __FILE__)
             class SettingTest < ActiveSupport::TestCase
               def teardown
                 Setting.clear_cache
               end
               def test_read_default
                 assert_equal "Redmine", Setting.app_title
                 assert Setting.self_registration?
                 assert !Setting.login_required?
               end
               def test_update
                 Setting.app_title = "My title"
                 assert_equal "My title", Setting.app_title
                 # make sure db has been updated (INSERT)
                 assert_equal "My title", Setting.find_by_name('app_title').value
                 Setting.app_title = "My other title"
                 assert_equal "My other title", Setting.app_title
                 # make sure db has been updated (UPDATE)
                 assert_equal "My other title", Setting.find_by_name('app_title').value
               end
               def test_setting_with_int_format_should_accept_numeric_only
                 with_settings :session_timeout => 30 do
                   Setting.session_timeout = 'foo'
                   assert_equal "30", Setting.session_timeout
                   Setting.session_timeout = 40
                   assert_equal "40", Setting.session_timeout
                 end
               end
               def test_setting_with_invalid_name_should_be_valid
                 setting = Setting.new(:name => "does_not_exist", :value => "should_not_be_allowed")
                 assert !setting.save
               end
               def test_serialized_setting
                 Setting.notified_events = ['issue_added', 'issue_updated', 'news_added']
                 assert_equal ['issue_added', 'issue_updated', 'news_added'], Setting.notified_events
                 assert_equal ['issue_added', 'issue_updated', 'news_added'], Setting.find_by_name('notified_events').value
               end
               def test_setting_should_be_reloaded_after_clear_cache
                 Setting.app_title = "My title"
                 assert_equal "My title", Setting.app_title
                 s = Setting.find_by_name("app_title")
                 s.value = 'New title'
                 s.save!
                 assert_equal "My title", Setting.app_title
                 Setting.clear_cache
                 assert_equal "New title", Setting.app_title
               end
               def test_per_page_options_array_should_be_an_empty_array_when_setting_is_blank
                 with_settings :per_page_options => nil do
                   assert_equal [], Setting.per_page_options_array
                 end
                 with_settings :per_page_options => '' do
                   assert_equal [], Setting.per_page_options_array
                 end
               end
               def test_per_page_options_array_should_be_an_array_of_integers
                 with_settings :per_page_options => '10, 25, 50' do
                   assert_equal [10, 25, 50], Setting.per_page_options_array
                 end
               end
               def test_per_page_options_array_should_omit_non_numerial_values
                 with_settings :per_page_options => 'a, 25, 50' do
                   assert_equal [25, 50], Setting.per_page_options_array
                 end
               end
               def test_per_page_options_array_should_be_sorted
                 with_settings :per_page_options => '25, 10, 50' do
                   assert_equal [10, 25, 50], Setting.per_page_options_array
                 end
               end
+              def test_setting_serialied_as_binary_should_be_loaded_as_utf8_encoded_strings
+                yaml = <<-YAML
+            ---
+            - keywords: !binary |
+                Zml4ZXMsY2xvc2VzLNC40YHQv9GA0LDQstC70LXQvdC+LNCz0L7RgtC+0LLQ
+                vizRgdC00LXQu9Cw0L3QvixmaXhlZA==
+              done_ratio: "100"
+              status_id: "5"
+            YAML
+                Setting.commit_update_keywords = {}
+                assert_equal 1, Setting.where(:name => 'commit_update_keywords').update_all(:value => yaml)
+                Setting.clear_cache
+                assert_equal 'UTF-8', Setting.commit_update_keywords.first['keywords'].encoding.name
+              ensure
+                Setting.where(:name => 'commit_update_keywords').delete_all
+                Setting.clear_cache
+              end
             end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages