Merge remote-tracking branch 'origin/support/2.5' into support/2.6

Was already committed to develop with e59d472c

application/transaction.class.inc.php

@@ -193,16 +193,19 @@ class privUITransactionSession
  */
 class privUITransactionFile
 {
+	/** @var int Value to use when no user logged */
+	const UNAUTHENTICATED_USER_ID = -666;
+
 	/**
-	 * @return int
+	 * @return int current user id, or {@see self::UNAUTHENTICATED_USER_ID} if no user logged
-	 * @throws \SecurityException if no connected user
 	 *
 	 * @since 2.6.5 2.7.6 3.0.0 N°4289 method creation
 	 */
-	private static function GetCurrentUserId() {
+	private static function GetCurrentUserId()
+	{
 		$iCurrentUserId = UserRights::GetConnectedUserId();
 		if ('' === $iCurrentUserId) {
-			throw new SecurityException('Cannot creation transaction_id when no user logged');
+			$iCurrentUserId = static::UNAUTHENTICATED_USER_ID;
 		}
 
 		return $iCurrentUserId;

application/ui.extkeywidget.class.inc.php

@@ -373,7 +373,7 @@ EOF
 		$sHTML .= "</form>\n";
 		$sHTML .= '</div></div>';
 
-		$sDialogTitleSanitized = utils::HtmlToText($sTitle);
+		$sDialogTitleSanitized = addslashes(utils::HtmlToText($sTitle));
 		$oPage->add_ready_script(
 <<<EOF
 		$('#ac_dlg_{$this->iId}').dialog({ width: $(window).width()*0.8, height: $(window).height()*0.8, autoOpen: false, modal: true, title: '$sDialogTitleSanitized', resizeStop: oACWidget_{$this->iId}.UpdateSizes, close: oACWidget_{$this->iId}.OnClose });

pages/ajax.render.php

@@ -1066,7 +1066,7 @@ try
 			break;
 
 		case 'save_dashboard':
-			$sDashboardId = utils::ReadParam('dashboard_id', '', false, 'element_identifier');
+			$sDashboardId = utils::ReadParam('dashboard_id', '', false, 'context_param');
 			$aExtraParams = utils::ReadParam('extra_params', array(), false, 'raw_data');
 			$sReloadURL = utils::ReadParam('reload_url', '', false, 'raw_data');
 			$sJSExtraParams = json_encode($aExtraParams);
@@ -1076,22 +1076,26 @@ try
 			$aParams['auto_reload'] = utils::ReadParam('auto_reload', false);
 			$aParams['auto_reload_sec'] = utils::ReadParam('auto_reload_sec', 300);
 			$aParams['cells'] = utils::ReadParam('cells', array(), false, 'raw_data');
+
 			$oDashboard = new RuntimeDashboard($sDashboardId);
 			$oDashboard->FromParams($aParams);
 			$oDashboard->Save();
+
 			$sDashboardFile = addslashes(utils::ReadParam('file', '', false, 'string'));
+			$sDashboardDivId = preg_replace('/[^a-zA-Z0-9_]/', '', $sDashboardId);
+
 			// trigger a reload of the current page since the dashboard just changed
 			$oPage->add_script(
-				<<<EOF
+				<<<JS
-			$('.dashboard_contents#$sDashboardId').block();
+			$('.dashboard_contents#{$sDashboardDivId}').block();
 			$.post(GetAbsoluteUrlAppRoot()+'pages/ajax.render.php',
-			   { operation: 'reload_dashboard', dashboard_id: '$sDashboardId', file: '$sDashboardFile', extra_params: $sJSExtraParams, reload_url: '$sReloadURL'},
+			   { operation: 'reload_dashboard', dashboard_id: '{$sDashboardId}', file: '{$sDashboardFile}', extra_params: {$sJSExtraParams}, reload_url: '{$sReloadURL}'},
 			   function(data){
-				 $('.dashboard_contents#$sDashboardId').html(data);
+				 $('.dashboard_contents#{$sDashboardDivId}').html(data);
-				 $('.dashboard_contents#$sDashboardId').unblock();
+				 $('.dashboard_contents#{$sDashboardDivId}').unblock();
 				}
 			 );
-EOF
+JS
 			);
 			break;
 

sources/renderer/bootstrap/fieldrenderer/bslinkedsetfieldrenderer.class.inc.php

@@ -363,7 +363,7 @@ JS
 											oData.items[i].target_id = oData.items[i].id;
 											
 											// Adding item to table only if it's not already there
-											if($('#{$sTableId} tr[role="row"] > td input[data-target-object-id="' + oData.items[i].target_id + '"], #{$sTableId} tr[role="row"] > td input[data-target-object-id="' + (oData.items[i].target_id*-1) + '"]').length === 0)
+											if($('#{$sTableId} tr[id] > td input[data-target-object-id="' + oData.items[i].target_id + '"], #{$sTableId} tr[id] > td input[data-target-object-id="' + (oData.items[i].target_id*-1) + '"]').length === 0)
 											{
 												// Making id negative in order to recognize it when persisting
 												oData.items[i].id = -1 * parseInt(oData.items[i].id);
@@ -430,7 +430,7 @@ EOF
 				$sAddButtonEndpoint = str_replace('-sMode-', 'from-attribute', $this->oField->GetSearchEndpoint());
 				// - Output
 				$oOutput->AddJs(
-	<<<EOF
+	<<<JS
 					// Handles items selection/deselection
 					// - Remove button state handler
 					var updateRemoveButtonState_{$this->oField->GetGlobalId()} = function()
@@ -457,7 +457,7 @@ EOF
 					    // Checking removed objects
 					    for(var i in oValues.current)
 					    {
-					        if($('#{$sTableId} tr[role="row"] input[data-object-id="'+i+'"]').length === 0)
+					        if($('#{$sTableId} tr[id="'+i+'"]').length === 0)
                             {
                                 oValues.remove[i] = {};
                             }
@@ -492,7 +492,7 @@ EOF
 					$('#{$sButtonAddId}').off('click').on('click', function(){
 						// Preparing current values
 						var aObjectIdsToIgnore = [];
-						$('#{$sTableId} tr[role="row"] > td input[data-target-object-id]').each(function(iIndex, oElem){
+						$('#{$sTableId} tr[id] > td input[data-target-object-id]').each(function(iIndex, oElem){
 							aObjectIdsToIgnore.push( $(oElem).attr('data-target-object-id') );
 						});
 						// Creating a new modal
@@ -527,7 +527,7 @@ EOF
 						);
 						oModalElem.modal('show');
 					});
-EOF
+JS
 				);
 			}
 		}

test/application/privUITransactionFileTest.php

@@ -37,5 +37,13 @@ class privUITransactionFileTest extends \Combodo\iTop\Test\UnitTest\ItopDataTest
 		$this->assertTrue($bUser1Login2, 'Login with user1 throw an error');
 		$bResult = privUITransactionFile::RemoveTransaction($sTransactionIdUserSupport);
 		$this->assertTrue($bResult, 'Token created by support user must be removed in the support user context');
+
+		// test when no user logged (combodo-unauthenticated-form module for example)
+		UserRights::_ResetSessionCache();
+		$sTransactionIdUnauthenticatedUser = privUITransactionFile::GetNewTransactionId();
+		$bResult = privUITransactionFile::IsTransactionValid($sTransactionIdUnauthenticatedUser, false);
+		$this->assertTrue($bResult, 'Token created by unauthenticated user must be valid when no user logged');
+		$bResult = privUITransactionFile::RemoveTransaction($sTransactionIdUnauthenticatedUser);
+		$this->assertTrue($bResult, 'Token created by unauthenticated user must be removed when no user logged');
 	}
 }