Merge branch 'stable'

Rodrigo Souto
2 parents d606d2a1 0db12ddd
Showing 19 changed files with 118 additions and 17 deletions Show diff stats
app/helpers/application_helper.rb
app/models/approve_article.rb
app/models/environment.rb
app/models/image.rb
app/models/thumbnail.rb
app/models/uploaded_file.rb
config/initializers/active_record_extensions.rb
debian/changelog
features/approve_article.feature
features/profile_domain.feature
lib/feed_handler.rb
lib/noosfero.rb
lib/upload_sanitizer.rb
test/fixtures/files/hello_world.php
test/unit/environment_test.rb
test/unit/feed_handler_test.rb
test/unit/image_test.rb
test/unit/thumbnail_test.rb
test/unit/uploaded_file_test.rb
@@ -1121,7 +1121,7 @@ module ApplicationHelper
     (_('Welcome, %s') % link_to('<i></i><strong>{login}</strong>', @environment.top_url + '/{login}', :id => "homepage-link", :title => _('Go to your homepage'))) +
     render_environment_features(:usermenu) +
-    link_to('<i class="icon-menu-admin"></i><strong>' + _('Administration') + '</strong>', { :host => @environment.default_hostname, :controller => 'admin_panel', :action => 'index' }, :id => "controlpanel", :title => _("Configure the environment"), :class => 'admin-link', :style => 'display: none') +
+    link_to('<i class="icon-menu-admin"></i><strong>' + _('Administration') + '</strong>', @environment.top_url + '/admin', :id => "controlpanel", :title => _("Configure the environment"), :class => 'admin-link', :style => 'display: none') +
     manage_enterprises.to_s +
     link_to('<i class="icon-menu-ctrl-panel"></i><strong>' + _('Control panel') + '</strong>', @environment.top_url + '/myprofile/{login}', :id => "controlpanel", :title => _("Configure your personal account and content")) +
     pending_tasks_count +
@@ -77,6 +77,10 @@ class ApproveArticle &lt; Task
     true
   end
+  def reject_details
+    true
+  end
+
   def default_decision
     if article
       'skip'
@@ -107,4 +111,11 @@ class ApproveArticle &lt; Task
     end
   end
+  def task_cancelled_message
+    message = _('Your request for publishing the article "{article}" was rejected.')
+    if !reject_explanation.blank?
+      message += " " + _("Here is the reject explanation left by the administrator who rejected your article: \n\n%{reject_explanation}") % {:reject_explanation => reject_explanation}
+    end
+  end
+
 end
@@ -9,6 +9,13 @@ class Environment &lt; ActiveRecord::Base
   has_many :tasks, :dependent => :destroy, :as => 'target'
+  IDENTIFY_SCRIPTS = /(?:php[0-9s]?(\..*)?|[sp]htm[l]?(\..*)?|pl|py|cgi|rb)/
+
+  def self.verify_filename(filename)
+    filename += '.txt' if filename =~ IDENTIFY_SCRIPTS
+    filename
+  end
+
   PERMISSIONS['Environment'] = {
     'view_environment_admin_panel' => N_('View environment admin panel'),
     'edit_environment_features' => N_('Edit environment features'),
@@ -523,9 +530,6 @@ class Environment &lt; ActiveRecord::Base
       domain = (self.domains.find_by_is_default(true) || self.domains.find(:first, :order => 'id')).name
       domain = email_hostname ? domain : (force_www ? ('www.' + domain) : domain)
     end
-    if Noosfero.url_options.has_key?(:port)
-      domain += ":#{Noosfero.url_options[:port]}"
-    end
     domain
   end
@@ -4,6 +4,8 @@ class Image &lt; ActiveRecord::Base
     Image.attachment_options[:max_size]
   end
+  sanitize_filename
+
   has_attachment :content_type => :image, 
                  :storage => :file_system, 
                  :path_prefix => 'public/image_uploads',
@@ -3,5 +3,7 @@ class Thumbnail &lt; ActiveRecord::Base
     :content_type => :image, :max_size => 5.megabytes
   validates_as_attachment
+  sanitize_filename
+
   postgresql_attachment_fu
 end
@@ -18,6 +18,8 @@ class UploadedFile &lt; Article
   validates_size_of :title, :maximum => 60, :if => (lambda { |file| !file.title.blank? })
+  sanitize_filename
+
   before_create do |uploaded_file|
     uploaded_file.is_image = true if uploaded_file.image?
   end
@@ -0,0 +1 @@
+require 'upload_sanitizer'
-noosfero (0.31.2) lucid; urgency=low
+noosfero (0.31.3) unstable; urgency=low
+
+  * Bugfix Version release.
+
+ -- Rodrigo <rodrigo@colivre.coop.br>  Thu, 16 Jun 2011 11:13:42 -0300
+
+noosfero (0.31.2) unstable; urgency=low
   * Bugfix Version release.
@@ -5,9 +5,9 @@ Feature: approve article
   Background:
     Given the following users
-      | login | name |
-      | joaosilva | Joao Silva |
-      | mariasilva | Maria Silva |
+      | login      | name        | email                  |
+      | joaosilva  | Joao Silva  | joaosilva@example.com  |
+      | mariasilva | Maria Silva | mariasilva@example.com |
     And the following articles
       | owner | name | body | homepage |
       | mariasilva | Sample Article | This is an article | true |
@@ -34,3 +34,20 @@ Feature: approve article
     And I go to Sample Community's sitemap
     And I follow "Sample Article"
     Then I should see "This is an article edited"
+
+  @selenium
+  Scenario: reject an article with explanation
+    Given I am logged in as "mariasilva"
+    And I go to Maria Silva's cms
+    And I follow "Sample Article"
+    And I follow "Spread" and wait
+    And I check "Sample Community"
+    And I press "Spread this"
+    And I am logged in as "joaosilva"
+    And I go to Sample Community's control panel
+    And I follow "Process requests" and wait
+    And I choose "Reject"
+    And I fill in "Rejection explanation" with "This is not an appropriate article for this community."
+    And I press "Apply!"
+    When I go to Sample Community's sitemap
+    Then I should not see "Sample Article"
@@ -69,4 +69,4 @@ Feature: domain for profile
   Scenario: Compose link to administration with environment domain
     Given I am logged in as "joaosilva"
     When I visit "/" and wait
-    Then I should see "Administration" linking to "http://127.0.0.1:3001/admin"
+    Then I should see "Administration" linking to "http://127.0.0.1/admin"
@@ -65,7 +65,12 @@ class FeedHandler
       if container.update_errors > FeedHandler.max_errors
         container.enabled = false
       end
-      container.finish_fetch
+      begin
+        container.finish_fetch
+      rescue Exception => finish_fetch_exception
+        RAILS_DEFAULT_LOGGER.warn("Unable to finish fetch from %s ID %d\n%s" % [container.class.name, container.id, finish_fetch_exception.to_s])
+        RAILS_DEFAULT_LOGGER.warn("Backtrace:\n%s" % finish_fetch_exception.backtrace.join("\n"))
+      end
     end
   end
 module Noosfero
   PROJECT = 'noosfero'
-  VERSION = '0.31.2'
+  VERSION = '0.31.3'
   def self.pattern_for_controllers_in_directory(dir)
     disjunction = controllers_in_directory(dir).join('|')
@@ -0,0 +1,13 @@
+module UploadSanitizer
+  def self.included(base)
+    base.extend(ClassMethods)
+  end
+
+  module ClassMethods
+    def sanitize_filename
+      before_create { |file| file.filename = Environment.verify_filename(file.filename) }
+    end
+  end
+end
+
+ActiveRecord::Base.send(:include, UploadSanitizer)
@@ -0,0 +1 @@
+<? print("Hello World"); ?>
@@ -234,11 +234,9 @@ class EnvironmentTest &lt; Test::Unit::TestCase
   should 'include port in default top URL for development environment' do
     env = Environment.new
-    env.expects(:default_hostname).returns('www.lalala.net')
-
     Noosfero.expects(:url_options).returns({ :port => 9999 }).at_least_once
-    assert_equal 'http://www.lalala.net:9999', env.top_url
+    assert_equal 'http://localhost:9999', env.top_url
   end
   should 'use https when asked for a ssl url' do
@@ -1119,10 +1117,27 @@ class EnvironmentTest &lt; Test::Unit::TestCase
     assert_equal ["Meter", "Kilo", "Litre"], Environment.default.units.map(&:singular)
   end
-  should 'include port in default hostname for development environment' do
+  should 'not include port in default hostname' do
     env = Environment.new
-    Noosfero.expects(:url_options).returns({ :port => 9999 }).at_least_once
-    assert_equal 'localhost:9999', env.default_hostname
+    Noosfero.stubs(:url_options).returns({ :port => 9999 })
+    assert_no_match /9999/, env.default_hostname
+  end
+
+  should 'identify scripts with regex' do
+    scripts_extensions = %w[php php1 php4 phps php.bli cgi shtm phtm shtml phtml pl py rb]
+    name = 'uploaded_file'
+    scripts_extensions.each do |extension|
+      assert_not_nil name+'.'+extension =~ Environment::IDENTIFY_SCRIPTS
+    end
+  end
+
+  should 'verify filename and append .txt if script' do
+    scripts_extensions = %w[php php1 php4 phps php.bli cgi shtm phtm shtml phtml pl py rb]
+    name = 'uploaded_file'
+    scripts_extensions.each do |extension|
+      filename = name+'.'+extension
+      assert_equal filename+'.txt', Environment.verify_filename(filename)
+    end
   end
 end
@@ -114,4 +114,11 @@ class FeedHandlerTest &lt; Test::Unit::TestCase
     end
   end
+  should 'not crash even when finish fetch fails' do
+    container.stubs(:finish_fetch).raises(Exception.new("crash"))
+    assert_nothing_raised do
+      handler.process(container)
+    end
+  end
+
 end
@@ -118,4 +118,9 @@ class ImageTest &lt; Test::Unit::TestCase
     file.destroy
   end
+  should 'not allow script files to be uploaded without append .txt in the end' do
+    file = Image.create!(:uploaded_data => fixture_file_upload('files/hello_world.php', 'image/png'))
+    assert_equal 'hello_world.php.txt', file.filename
+  end
+
 end
@@ -9,5 +9,10 @@ class ThumbnailTest &lt; Test::Unit::TestCase
       assert_match 'image/', item 
     end
   end
+
+  should 'not allow script files to be uploaded without append .txt in the end' do
+    file = Thumbnail.create!(:uploaded_data => fixture_file_upload('files/hello_world.php', 'image/png'))
+    assert_equal 'hello_world.php.txt', file.filename
+  end
 end
@@ -325,4 +325,9 @@ class UploadedFileTest &lt; Test::Unit::TestCase
     uses_sqlite
   end
+  should 'not allow script files to be uploaded without append .txt in the end' do
+    file = UploadedFile.create!(:uploaded_data => fixture_file_upload('files/hello_world.php', 'application/x-php'), :profile => @profile)
+    assert_equal 'hello_world.php.txt', file.filename
+  end
+
 end
	@@ -1121,7 +1121,7 @@ module ApplicationHelper		@@ -1121,7 +1121,7 @@ module ApplicationHelper
1121		1121
1122	(_('Welcome, %s') % link_to('<i></i><strong>{login}</strong>', @environment.top_url + '/{login}', :id => "homepage-link", :title => _('Go to your homepage'))) +	1122	(_('Welcome, %s') % link_to('<i></i><strong>{login}</strong>', @environment.top_url + '/{login}', :id => "homepage-link", :title => _('Go to your homepage'))) +
1123	render_environment_features(:usermenu) +	1123	render_environment_features(:usermenu) +
1124	- link_to('<i class="icon-menu-admin"></i><strong>' + _('Administration') + '</strong>', { :host => @environment.default_hostname, :controller => 'admin_panel', :action => 'index' }, :id => "controlpanel", :title => _("Configure the environment"), :class => 'admin-link', :style => 'display: none') +	1124	+ link_to('<i class="icon-menu-admin"></i><strong>' + _('Administration') + '</strong>', @environment.top_url + '/admin', :id => "controlpanel", :title => _("Configure the environment"), :class => 'admin-link', :style => 'display: none') +
1125	manage_enterprises.to_s +	1125	manage_enterprises.to_s +
1126	link_to('<i class="icon-menu-ctrl-panel"></i><strong>' + _('Control panel') + '</strong>', @environment.top_url + '/myprofile/{login}', :id => "controlpanel", :title => _("Configure your personal account and content")) +	1126	link_to('<i class="icon-menu-ctrl-panel"></i><strong>' + _('Control panel') + '</strong>', @environment.top_url + '/myprofile/{login}', :id => "controlpanel", :title => _("Configure your personal account and content")) +
1127	pending_tasks_count +	1127	pending_tasks_count +
	@@ -77,6 +77,10 @@ class ApproveArticle < Task		@@ -77,6 +77,10 @@ class ApproveArticle < Task
77	true	77	true
78	end	78	end
79		79
		80	+ def reject_details
		81	+ true
		82	+ end
		83	+
80	def default_decision	84	def default_decision
81	if article	85	if article
82	'skip'	86	'skip'
	@@ -107,4 +111,11 @@ class ApproveArticle < Task		@@ -107,4 +111,11 @@ class ApproveArticle < Task
107	end	111	end
108	end	112	end
109		113
		114	+ def task_cancelled_message
		115	+ message = _('Your request for publishing the article "{article}" was rejected.')
		116	+ if !reject_explanation.blank?
		117	+ message += " " + _("Here is the reject explanation left by the administrator who rejected your article: \n\n%{reject_explanation}") % {:reject_explanation => reject_explanation}
		118	+ end
		119	+ end
		120	+
110	end	121	end
	@@ -3,5 +3,7 @@ class Thumbnail < ActiveRecord::Base		@@ -3,5 +3,7 @@ class Thumbnail < ActiveRecord::Base
3	:content_type => :image, :max_size => 5.megabytes	3	:content_type => :image, :max_size => 5.megabytes
4	validates_as_attachment	4	validates_as_attachment
5		5
		6	+ sanitize_filename
		7	+
6	postgresql_attachment_fu	8	postgresql_attachment_fu
7	end	9	end
	@@ -18,6 +18,8 @@ class UploadedFile < Article		@@ -18,6 +18,8 @@ class UploadedFile < Article
18		18
19	validates_size_of :title, :maximum => 60, :if => (lambda { \|file\| !file.title.blank? })	19	validates_size_of :title, :maximum => 60, :if => (lambda { \|file\| !file.title.blank? })
20		20
		21	+ sanitize_filename
		22	+
21	before_create do \|uploaded_file\|	23	before_create do \|uploaded_file\|
22	uploaded_file.is_image = true if uploaded_file.image?	24	uploaded_file.is_image = true if uploaded_file.image?
23	end	25	end
1	-noosfero (0.31.2) lucid; urgency=low	1	+noosfero (0.31.3) unstable; urgency=low
		2	+
		3	+ * Bugfix Version release.
		4	+
		5	+ -- Rodrigo <rodrigo@colivre.coop.br> Thu, 16 Jun 2011 11:13:42 -0300
		6	+
		7	+noosfero (0.31.2) unstable; urgency=low
2		8
3	* Bugfix Version release.	9	* Bugfix Version release.
4		10
	@@ -5,9 +5,9 @@ Feature: approve article		@@ -5,9 +5,9 @@ Feature: approve article
5		5
6	Background:	6	Background:
7	Given the following users	7	Given the following users
8	- \| login \| name \|
9	- \| joaosilva \| Joao Silva \|
10	- \| mariasilva \| Maria Silva \|	8	+ \| login \| name \| email \|
		9	+ \| joaosilva \| Joao Silva \| joaosilva@example.com \|
		10	+ \| mariasilva \| Maria Silva \| mariasilva@example.com \|
11	And the following articles	11	And the following articles
12	\| owner \| name \| body \| homepage \|	12	\| owner \| name \| body \| homepage \|
13	\| mariasilva \| Sample Article \| This is an article \| true \|	13	\| mariasilva \| Sample Article \| This is an article \| true \|
	@@ -34,3 +34,20 @@ Feature: approve article		@@ -34,3 +34,20 @@ Feature: approve article
34	And I go to Sample Community's sitemap	34	And I go to Sample Community's sitemap
35	And I follow "Sample Article"	35	And I follow "Sample Article"
36	Then I should see "This is an article edited"	36	Then I should see "This is an article edited"
		37	+
		38	+ @selenium
		39	+ Scenario: reject an article with explanation
		40	+ Given I am logged in as "mariasilva"
		41	+ And I go to Maria Silva's cms
		42	+ And I follow "Sample Article"
		43	+ And I follow "Spread" and wait
		44	+ And I check "Sample Community"
		45	+ And I press "Spread this"
		46	+ And I am logged in as "joaosilva"
		47	+ And I go to Sample Community's control panel
		48	+ And I follow "Process requests" and wait
		49	+ And I choose "Reject"
		50	+ And I fill in "Rejection explanation" with "This is not an appropriate article for this community."
		51	+ And I press "Apply!"
		52	+ When I go to Sample Community's sitemap
		53	+ Then I should not see "Sample Article"
	@@ -69,4 +69,4 @@ Feature: domain for profile		@@ -69,4 +69,4 @@ Feature: domain for profile
69	Scenario: Compose link to administration with environment domain	69	Scenario: Compose link to administration with environment domain
70	Given I am logged in as "joaosilva"	70	Given I am logged in as "joaosilva"
71	When I visit "/" and wait	71	When I visit "/" and wait
72	- Then I should see "Administration" linking to "http://127.0.0.1:3001/admin"	72	+ Then I should see "Administration" linking to "http://127.0.0.1/admin"
1	module Noosfero	1	module Noosfero
2	PROJECT = 'noosfero'	2	PROJECT = 'noosfero'
3	- VERSION = '0.31.2'	3	+ VERSION = '0.31.3'
4		4
5	def self.pattern_for_controllers_in_directory(dir)	5	def self.pattern_for_controllers_in_directory(dir)
6	disjunction = controllers_in_directory(dir).join('\|')	6	disjunction = controllers_in_directory(dir).join('\|')
@@ -0,0 +1,13 @@		@@ -0,0 +1,13 @@
	1	+module UploadSanitizer
	2	+ def self.included(base)
	3	+ base.extend(ClassMethods)
	4	+ end
	5	+
	6	+ module ClassMethods
	7	+ def sanitize_filename
	8	+ before_create { \|file\| file.filename = Environment.verify_filename(file.filename) }
	9	+ end
	10	+ end
	11	+end
	12	+
	13	+ActiveRecord::Base.send(:include, UploadSanitizer)
	@@ -114,4 +114,11 @@ class FeedHandlerTest < Test::Unit::TestCase		@@ -114,4 +114,11 @@ class FeedHandlerTest < Test::Unit::TestCase
114	end	114	end
115	end	115	end
116		116
		117	+ should 'not crash even when finish fetch fails' do
		118	+ container.stubs(:finish_fetch).raises(Exception.new("crash"))
		119	+ assert_nothing_raised do
		120	+ handler.process(container)
		121	+ end
		122	+ end
		123	+
117	end	124	end