Release OpenProject 13.4.2

opf · May 22, 2024 · 540f21f · 540f21f
2 parents 803e8cd + d1174ca
commit 540f21f
Show file tree

Hide file tree

Showing 18 changed files with 88 additions and 44 deletions.
diff --git a/config/locales/en.yml b/config/locales/en.yml
@@ -3021,7 +3021,7 @@ en:
         Remaining files have been scanned. There are %{file_count} in quarantine.
         You are being redirected to the quarantine page. Use this page to delete or override quarantined files.
       remaining_rescanned_files: >
-        Virus scanning has been enabled successfuly.
+        Virus scanning has been enabled successfully.
         There are %{file_count} that were uploaded previously and still need to be scanned.
         This process has been scheduled in the background. The files will remain accessible during the scan.
       upsale:

diff --git a/docs/development/application-architecture/README.md b/docs/development/application-architecture/README.md
diff --git a/docs/enterprise-guide/enterprise-on-premises-guide/README.md b/docs/enterprise-guide/enterprise-on-premises-guide/README.md
@@ -22,6 +22,3 @@ The Enterprise on-premises edition builds on top of the free Community edition.
 | [Enterprise on-premises trial](./enterprise-on-premises-trial/)       | Can I test the Enterprise on-premises edition for free?                      |
 | [Activate Enterprise on-premises](./activate-enterprise-on-premises/) | How can I upgrade my Community edition to an Enterprise on-premises edition? |
 | [Support](../support/)                                                | How can I get support or installation support?                               |
-
-![](https://openproject-docs.s3.eu-central-1.amazonaws.com/videos/5-Reasons-to-upgrade-to-the-OpenProject-Enterprise-Edition.mp4)
-
diff --git a/docs/installation-and-operations/installation-faq/README.md b/docs/installation-and-operations/installation-faq/README.md
@@ -28,6 +28,10 @@ You can either try the OUTDATED and OLD manual installation guide, or add a Feat
 
 We recommend the Linux packages [if you have a compatible distribution](../system-requirements/) and a separate machine for OpenProject, since it will allow for the easiest and most flexible setup. Use a Docker-based image either for quickly spinning up an environment or if you have knowledge in setting up and maintaining Docker-based installations.
 
+### Are there any default ports that should be closed for security reasons?
+
+Anything besides 443 and 80 should be closed on a  system hosting OpenProject by default. You may need SSH (port 22), but that should only be open to whitelisted IPs.
+
 ### Can I use a virtual machine (VM) to install OpenProject?
 
 You can use a virtual machine as long as the hardware and the operating system match the system requirements. However, the virtual machine may be less powerful. Installing on a virtual machine could be an alternative to Docker if you would like to install OpenProject in a Windows environment. However, we can't officially support this.
@@ -120,6 +124,8 @@ You can access it using a browser. Please see our [Installation & Upgrades Guide
 
 Set a higher number of web workers to allow more processes to be handled at the same time. Find out more [here](../operation/control) and about system requirements [here](../system-requirements/).
 
+
+
 ### I don't receive emails. Test email works fine but not the one for work package updates.
 
 There are two different types of emails in OpenProject: One sent directly within the request to the server (this includes the test mail) and one sent asynchronously, via a background job from the backend. The majority of mail sending jobs is run asynchronously to facilitate a faster response time for server request.
@@ -174,3 +180,11 @@ The package based installation is intended to be run on a dedicated system. Dedi
 In case the database is stored on a different system, e.g. within a database cluster, it needs to be removed separately. The database URL can be found within the OpenProject installation, via `openproject config:get DATABASE_URL`.
 
 In case the attachments are stored on a different system, e.g. on an NFS or on S3, they also need to be removed separately.
+
+### Does OpenProject prohibit users from logging into the application on more than one workstation at the same time with the same user ID?
+
+It doesn't by default. There is a setting which enables this option: drop_old_sessions_on_login.
+
+### Can the OpenProject force password expiration and prevent users from reusing a password?
+
+There is no password expiration in OpenProject, but OpenProject can prevent the re-use of previous passwords via the password_count_former_banned setting. If you use an LDAP-Server for login that has this feature, you can archive this via your LDAP-Server. Other identity providers (e.g. KeyCloak) used via OpenID Connect or SAML can also do this. You can set up these rules in these identity providers directly and use them for authentication.
diff --git a/docs/installation-and-operations/installation/README.md b/docs/installation-and-operations/installation/README.md
@@ -8,12 +8,13 @@ sidebar_navigation:
 
 OpenProject can be setup in three different ways:
 
-| Topic                                                        | Content                                                      |
-| ------------------------------------------------------------ | ------------------------------------------------------------ |
-| [Installation with DEB/RPM packages](./packaged)             | This is the recommended way to install OpenProject           |
-| [Installation with Docker](./docker)                         | This allows to setup OpenProject in an isolated manner using Docker |
-| [Installation with Univention Corporate Server](./univention) | OpenProject is available in the App Center and comes integrated with the identity management |
-| [Other](misc/)                                               | Extra information on installing OpenProject on specific platforms such as Kubernetes. |
+| Topic                                            | Content                                                      |
+| ------------------------------------------------ | ------------------------------------------------------------ |
+| [Installation with DEB/RPM packages](./packaged) | This is the recommended way to install OpenProject           |
+| [Installation with Docker](./docker)             | This allows to setup OpenProject in an isolated manner using Docker |
+| [Installation with Kubernetes](./kubernetes)     | This allows to setup OpenProject using Kubernetes            |
+| [Installation with Helm charts](./helm-chart)    | This allows to setup OpenProject using Helm charts           |
+| [Other](misc/)                                   | Extra information on installing OpenProject on specific platforms such as Kubernetes. |
 
 > **NOTE: We recommend using the DEB/RPM package installation.**
 

diff --git a/docs/release-notes/13-4-1/README.md b/docs/release-notes/13-4-1/README.md
@@ -24,7 +24,7 @@ The release contains several bug fixes and we recommend updating to the newest v
 - Bugfix: PT-BR translation works as PT-PT \[[#53584](https://community.openproject.org/wp/53584)\]
 - Bugfix: Work Package Table crashes when grouped by integer and sums are displayed \[[#53609](https://community.openproject.org/wp/53609)\]
 - Bugfix: SettingSeeder rake aborted! when upgrade from 13.3.0 to 13.4.0 \[[#53611](https://community.openproject.org/wp/53611)\]
-- Bugfix: Internal error (comparisson NilClass with String failed) on query 5000 on community \[[#53617](https://community.openproject.org/wp/53617)\]
+- Bugfix: Internal error (comparison NilClass with String failed) on query 5000 on community \[[#53617](https://community.openproject.org/wp/53617)\]
 
 <!-- END AUTOMATED SECTION -->
 <!-- Warning: Anything above this line will be automatically removed by the release script -->

diff --git a/docs/release-notes/13-4-2/README.md b/docs/release-notes/13-4-2/README.md
@@ -0,0 +1,26 @@
+---
+title: OpenProject 13.4.2
+sidebar_navigation:
+    title: 13.4.2
+release_version: 13.4.2
+release_date: 2024-05-22
+---
+
+# OpenProject 13.4.2
+
+Release date: 2024-05-22
+
+We released [OpenProject 13.4.2](https://community.openproject.org/versions/2058).
+The release contains several bug fixes and we recommend updating to the newest version.
+
+<!--more-->
+
+## Bug fixes and changes
+
+<!-- Warning: Anything within the below lines will be automatically removed by the release script -->
+<!-- BEGIN AUTOMATED SECTION -->
+
+- Bugfix: Improper escaping of custom field values in cost report \[[#55197](https://community.openproject.org/wp/55197)\]
+
+<!-- END AUTOMATED SECTION -->
+<!-- Warning: Anything above this line will be automatically removed by the release script -->
diff --git a/docs/release-notes/README.md b/docs/release-notes/README.md
@@ -14,6 +14,13 @@ Stay up to date and get an overview of the new features included in the releases
 <!--- New release notes are generated below. Do not remove comment. -->
 <!--- RELEASE MARKER -->
 
+## 13.4.2
+
+Release date: 2024-05-22
+
+[Release Notes](13-4-2/)
+
+
 ## 13.4.1
 
 Release date: 2024-03-26

diff --git a/docs/user-guide/backlogs-scrum/work-with-backlogs/README.md b/docs/user-guide/backlogs-scrum/work-with-backlogs/README.md
@@ -81,7 +81,7 @@ In a sprint, you can directly document necessary effort as story points. The ove
 
 You can easily edit story points directly from the backlogs view. In order to do so, simply click in the line of the work package you want to edit, and make the desired changes.
 
-In the same way, you can also edit the name, start and end date and status of a work package. To confirm your changes, press “*Enter*” on your keyboard. To cancel your changes, press **Escape*”.
+In the same way, you can also edit the name, start and end date and status of a work package. To confirm your changes, press “*Enter*” on your keyboard. To cancel your changes, press “*Escape*”.
 
 ![User-guide-backlogs-edit-story-points](User-guide-backlogs-edit-story-points.png)
 
@@ -110,7 +110,7 @@ The remaining story points per sprint are displayed in the chart. Optionally, th
 
 ![Burndown chart graph](17_BurndownChart2.png)
 
-    
+
 
 ## Print story cards
 

diff --git a/lib/open_project/text_formatting/filters/link_attribute_filter.rb b/lib/open_project/text_formatting/filters/link_attribute_filter.rb
@@ -38,7 +38,7 @@ def call
       end
 
       def links
-        doc.xpath(".//a[contains(@href,'/')]")
+        doc.css('a[href^="/"]')
       end
     end
   end

diff --git a/lib/open_project/version.rb b/lib/open_project/version.rb
@@ -33,7 +33,7 @@ module OpenProject
   module VERSION # :nodoc:
     MAJOR = 13
     MINOR = 4
-    PATCH = 1
+    PATCH = 2
 
     class << self
       # Used by semver to define the special version (if any).

diff --git a/modules/reporting/app/helpers/reporting_helper.rb b/modules/reporting/app/helpers/reporting_helper.rb
@@ -121,7 +121,7 @@ def field_representation_map(key, value)
     when :version_id                            then h(Version.find(value.to_i).name)
     when :singleton_value                       then ''
     when :status_id                             then h(Status.find(value.to_i).name)
-    when /custom_field\d+/                      then custom_value(key, value)
+    when /custom_field\d+/                      then h(custom_value(key, value))
     else h(value.to_s)
     end
   end
@@ -133,7 +133,7 @@ def custom_value(cf_identifier, value)
     # and then properly cast the value
     CustomValue
       .new(custom_field_id: cf_id, value:)
-      .typed_value
+      .formatted_value
   end
 
   def field_sort_map(key, value)

diff --git a/modules/reporting/spec/helpers/reporting_helper_spec.rb b/modules/reporting/spec/helpers/reporting_helper_spec.rb
@@ -63,7 +63,7 @@
 
         it 'returns the option value' do
           expect(field_representation_map("custom_field#{custom_field.id}", 3.0))
-            .to be 3.0
+            .to eq "3.0"
         end
       end
     end

diff --git a/spec/lib/open_project/text_formatting/markdown/lists_spec.rb b/spec/lib/open_project/text_formatting/markdown/lists_spec.rb
@@ -316,7 +316,7 @@
                           <li class="op-uc-list--item">
                             <input type="checkbox" class="op-uc-list--task-checkbox" disabled>
                             <span>asdfasdfasdf </span>
-                            <a class="op-uc-link" target="_top" href="https://example.com/" rel="noopener noreferrer">
+                            <a class="op-uc-link" href="https://example.com/" rel="noopener noreferrer">
                               <span>foobar</span>
                             </a>
                           </li>

diff --git a/spec/lib/open_project/text_formatting/markdown/mentions_spec.rb b/spec/lib/open_project/text_formatting/markdown/mentions_spec.rb
@@ -313,7 +313,7 @@
               let(:expected) do
                 <<~EXPECTED
                   <p class="op-uc-p">
-                    Link to <a class="user-mention op-uc-link" target="_top" href="http://openproject.org/users/#{user.id}" title="User Foo Barrit">Foo Barrit</a>
+                    Link to <a class="user-mention op-uc-link" href="http://openproject.org/users/#{user.id}" title="User Foo Barrit">Foo Barrit</a>
                   </p>
                 EXPECTED
               end

diff --git a/spec/lib/open_project/text_formatting/markdown/setting_variable_spec.rb b/spec/lib/open_project/text_formatting/markdown/setting_variable_spec.rb
@@ -61,12 +61,10 @@
           </p>
           <p class="op-uc-p">
             <a href="#{Rails.application.root_url}/foo/bar" rel="noopener noreferrer"
-               target="_top"
                class="op-uc-link">Link with setting</a>
           </p>
           <p class="op-uc-p">
             <a href="#{Rails.application.root_url}/foo/bar" rel="noopener noreferrer"
-               target="_top"
                class="op-uc-link">Saved and transformed link with setting</a>
           </p>
           <p class="op-uc-p">

diff --git a/spec/lib/open_project/text_formatting/markdown/user_provided_links_spec.rb b/spec/lib/open_project/text_formatting/markdown/user_provided_links_spec.rb
@@ -121,7 +121,7 @@
         let(:expected) do
           <<~EXPECTED
             <p class="op-uc-p">
-              Link to <a href="http://openproject.org/foo/bar" target="_top" class="op-uc-link" rel="noopener noreferrer">relative path</a>
+              Link to <a href="http://openproject.org/foo/bar" class="op-uc-link" rel="noopener noreferrer">relative path</a>
             </p>
           EXPECTED
         end

diff --git a/spec/requests/api/v3/render_resource_spec.rb b/spec/requests/api/v3/render_resource_spec.rb
@@ -72,8 +72,7 @@
                 <<~HTML
                   <p class="op-uc-p">
                     Hello World! This <em>is</em> markdown with a
-                    <a target="_top"
-                       href="http://community.openproject.org"
+                    <a href="http://community.openproject.org"
                        rel="noopener noreferrer"
                        class="op-uc-link">link</a>
                     and ümläutß.</p>