Seamus Lee [Thu, 20 Aug 2020 03:30:21 +0000 (13:30 +1000)]
Merge pull request #18195 from colemanw/customValueSave
APIv4 - Fix output of CustomValue create/save/update
Seamus Lee [Thu, 20 Aug 2020 03:13:51 +0000 (13:13 +1000)]
Merge pull request #18199 from civicrm/5.29
5.29
Seamus Lee [Thu, 20 Aug 2020 02:48:58 +0000 (12:48 +1000)]
Jenkins style fix
Coleman Watts [Wed, 19 Aug 2020 20:04:34 +0000 (16:04 -0400)]
APIv4 - Fix output of CustomValue create/save/update
Before: output contained no useful data
After: output contains values and id
Tim Otten [Thu, 20 Aug 2020 00:40:15 +0000 (17:40 -0700)]
Copy-edits for 5.28.1.md
Seamus Lee [Wed, 19 Aug 2020 07:41:16 +0000 (17:41 +1000)]
Add in release notes for 5.28.1
Seamus Lee [Thu, 20 Aug 2020 00:02:34 +0000 (10:02 +1000)]
Merge pull request #18197 from mattwire/removefirstcontribution
Remove first_contribution key from repeattransaction
Matthew Wire [Wed, 19 Aug 2020 22:33:37 +0000 (23:33 +0100)]
Remove first_contribution key from repeattransaction
colemanw [Wed, 19 Aug 2020 21:22:23 +0000 (17:22 -0400)]
Merge pull request #18182 from colemanw/severity
Remove unnecessary transformation of upgrade msg severity
colemanw [Wed, 19 Aug 2020 21:19:31 +0000 (17:19 -0400)]
Merge pull request #18114 from eileenmcnaughton/phone
Metadata fix - phone_type_id, location_type_id, gender_id
colemanw [Wed, 19 Aug 2020 14:13:12 +0000 (10:13 -0400)]
Merge pull request #18168 from twocs/patch-4
Check if $post defined before trying to use its field values.
Seamus Lee [Wed, 5 Aug 2020 20:31:22 +0000 (06:31 +1000)]
security/core#95 Purify Summary and description fields for events on the event info and event cart screens
Seamus Lee [Wed, 5 Aug 2020 23:46:33 +0000 (09:46 +1000)]
security/core#96 Escape the profile description field
Seamus Lee [Wed, 5 Aug 2020 23:57:26 +0000 (09:57 +1000)]
Apply edit groups permission check to the button not the generaal permissionedForGroup check
Seamus Lee [Tue, 28 Jul 2020 03:48:39 +0000 (13:48 +1000)]
[REF] Only show button to edit smart group if user has permissions
Seamus Lee [Wed, 29 Apr 2020 07:53:46 +0000 (17:53 +1000)]
Security/core#61 Limit Access to update smart group task to only if the logged in user has edit groups permission.
Put a permission restriction on loading page without manage groups permission when saved search id is specified in the URL
Seamus Lee [Wed, 15 Jul 2020 03:00:33 +0000 (13:00 +1000)]
security/core#94 Escape subject content when loading the Activity list for a contact
Coleman Watts [Fri, 3 Jul 2020 02:37:03 +0000 (22:37 -0400)]
Fix auto-refresh of CKEditor configurator form
Coleman Watts [Thu, 28 May 2020 20:26:47 +0000 (16:26 -0400)]
Convert CK Config form to quickform
Coleman Watts [Thu, 28 May 2020 19:15:26 +0000 (15:15 -0400)]
CKEditor Config - Validate input before saving config file
Also removes support for 'customConfig' supplimental file.
Coleman Watts [Thu, 28 May 2020 19:08:43 +0000 (15:08 -0400)]
CRM_Utils_JS - Improve validation of strings
Runs strings through json_decode to ensure they are valid.
Optionally throws an exception on error.
Seamus Lee [Fri, 29 May 2020 07:17:04 +0000 (17:17 +1000)]
security/core#78 Purify HTML of activity details field when viewing the activity
Tim Otten [Mon, 6 Apr 2020 08:07:12 +0000 (01:07 -0700)]
CRM_Core_Key - Strengthen signature algorithm
This alters the qfKey signature algorithm, with a few aims:
1. If someone wants to perform a brute-force to figure the per-session
private-key, we want it go slow. Therefore, use a slower hash (ie
HMAC-SHA256 instead of MD5).
2. If someone performs a timing attack aimed at figuring a passable qfKey,
the execution-time for `validate()` should not provide any hints.
3. If someone finds a way to manipulate one of the constituent parts
($sessionID, $name, $privateKey), we want it to be hard to create a
collsion. So... (a) Use HMAC instead of a vanilla hash. (b) Use delimiters
between the data sections ($sessionID, $name).
Tim Otten [Mon, 6 Apr 2020 06:33:55 +0000 (23:33 -0700)]
CRM_Core_Key - Improve entropy of "privateKey"
In PHP 4/5, there was no good, universal source of entropy. The old code
mitigated this by aggregating mediocre sources. On my system, it appears
to be roughly:
* 2^31 for each `mt_rand()`
* 10^8 =~ 2^26 for each `uniqid(...TRUE)` (after discounting the non-random right half of the uniqid).
So that's ~114 bits (albeit low-quality bits).
In PHP 7, the docs describe `random_bytes()` as "generat[ing] cryptographically secure pseudo-random bytes."
Seamus Lee [Thu, 28 May 2020 07:46:06 +0000 (17:46 +1000)]
Additional code from Drupal's implementation
Seamus Lee [Thu, 28 May 2020 07:43:19 +0000 (17:43 +1000)]
Update to use code from Drupal's patch
Seamus Lee [Thu, 28 May 2020 06:00:57 +0000 (16:00 +1000)]
Patch jQuery for CVE-2020-11022 and CVE-2020-11023
Coleman Watts [Tue, 12 May 2020 14:14:32 +0000 (10:14 -0400)]
security/core#81 Escape html in CRM_Core_LegacyErrorHandler messages
Seamus Lee [Tue, 12 May 2020 05:07:32 +0000 (15:07 +1000)]
security/core#74 Prevent CSRF in CKEditor Config screen by switching to using Quickform built form
Eileen McNaughton [Wed, 19 Aug 2020 04:13:07 +0000 (16:13 +1200)]
Merge pull request #18193 from civicrm/5.29
5.29 to master
Eileen McNaughton [Wed, 19 Aug 2020 03:47:37 +0000 (15:47 +1200)]
Merge pull request #18180 from eileenmcnaughton/recur
dev/core#1945 Fix recur access regression
Seamus Lee [Wed, 19 Aug 2020 03:03:05 +0000 (13:03 +1000)]
Merge pull request #18188 from demeritcowboy/mysqli-mysql
Put mysql back in civicrm.settings.php template
eileen [Mon, 17 Aug 2020 09:17:09 +0000 (21:17 +1200)]
dev/core#1945 Fix recur access regression
Eileen McNaughton [Tue, 18 Aug 2020 19:29:03 +0000 (07:29 +1200)]
Merge pull request #18189 from demeritcowboy/widget-notice
E_NOTICE on contribution page widget tab
demeritcowboy [Tue, 18 Aug 2020 14:27:12 +0000 (10:27 -0400)]
e_notice on widget tab
demeritcowboy [Tue, 18 Aug 2020 12:35:29 +0000 (08:35 -0400)]
put mysql back
Eileen McNaughton [Tue, 18 Aug 2020 06:25:52 +0000 (18:25 +1200)]
Merge pull request #18183 from colemanw/versionCheck
CRM_Utils_VersionCheck - respect force param
Eileen McNaughton [Tue, 18 Aug 2020 04:20:46 +0000 (16:20 +1200)]
Merge pull request #18174 from demeritcowboy/d8-upgrade-warning
dev/core#1937 - Upgrade message about needing composer patching turned on and updating mysql in DSN strings
Eileen McNaughton [Tue, 18 Aug 2020 04:19:11 +0000 (16:19 +1200)]
Merge pull request #18187 from seamuslee001/master
5.29
Seamus Lee [Tue, 18 Aug 2020 03:26:48 +0000 (13:26 +1000)]
Merge in 5.29
Eileen McNaughton [Tue, 18 Aug 2020 03:24:14 +0000 (15:24 +1200)]
Merge pull request #18185 from civicrm/revert-18091-xbutton-529
Revert "Swap out button/submit inputs for button elements"
Seamus Lee [Tue, 18 Aug 2020 02:28:16 +0000 (12:28 +1000)]
Merge pull request #18184 from totten/master-dao
(NFC) Update various DAO checksums
colemanw [Tue, 18 Aug 2020 00:49:42 +0000 (20:49 -0400)]
Revert "Swap out button/submit inputs for button elements"
demeritcowboy [Sun, 16 Aug 2020 21:24:04 +0000 (17:24 -0400)]
upgrade message about composer patches
Tim Otten [Tue, 18 Aug 2020 00:10:12 +0000 (17:10 -0700)]
Update various DAO checksums
Eileen McNaughton [Mon, 17 Aug 2020 21:37:04 +0000 (09:37 +1200)]
Merge pull request #18169 from demeritcowboy/no-discount
E_WARNING when saving event fees admin page if there's no discounts set
Coleman Watts [Mon, 17 Aug 2020 21:29:59 +0000 (17:29 -0400)]
CRM_Utils_VersionCheck - respect force param
Coleman Watts [Mon, 17 Aug 2020 20:55:21 +0000 (16:55 -0400)]
Remove unnecessary transformation of upgrade msg severity
Eileen McNaughton [Mon, 17 Aug 2020 20:03:22 +0000 (08:03 +1200)]
Merge pull request #18181 from colemanw/upgrademsg
Upgrade screen - show success instead of error if already upgraded
Coleman Watts [Mon, 17 Aug 2020 15:39:53 +0000 (11:39 -0400)]
Upgrade screen - show success instead of error if already upgraded
Matthew Wire [Mon, 17 Aug 2020 09:14:17 +0000 (10:14 +0100)]
Merge pull request #18177 from eileenmcnaughton/gross
Processors - remove gross_amount param from processors
Seamus Lee [Mon, 17 Aug 2020 02:49:06 +0000 (12:49 +1000)]
Merge pull request #18173 from civicrm/5.29
5.29
Seamus Lee [Mon, 17 Aug 2020 02:48:29 +0000 (12:48 +1000)]
Merge pull request #18176 from agileware/CIVICRM-1465
{contribution.receipt_date} token does not use any CiviCRM date formatter, output in YYYY-MM-DD HH:MM:SS format and {contribution.receive_date} also uses a non-standard format
eileen [Mon, 17 Aug 2020 00:34:53 +0000 (12:34 +1200)]
Processors - remove gross_amount param from processors
The gross_amount param is returned by a bunch of processors but is not used so this removes it.
The core processors are often used as a starting point for extensions - we can see for example
this parameter is present in IATS so removing it helps clarify it as unnecessary & unused
Seamus Lee [Sun, 16 Aug 2020 23:26:35 +0000 (09:26 +1000)]
Merge pull request #18175 from demeritcowboy/installation-doclinks
Installation doclinks not getting url-rewritten
Seamus Lee [Sun, 16 Aug 2020 22:31:46 +0000 (08:31 +1000)]
Merge pull request #18170 from eileenmcnaughton/testc
Minor cleanup in test class
demeritcowboy [Sun, 16 Aug 2020 22:29:50 +0000 (18:29 -0400)]
installation doclinks
Eileen McNaughton [Sun, 16 Aug 2020 21:52:05 +0000 (09:52 +1200)]
Merge pull request #18171 from demeritcowboy/unused-UTF8
[REF] Deprecate unused SQL temptable functions
Seamus Lee [Sun, 16 Aug 2020 21:00:19 +0000 (07:00 +1000)]
Merge pull request #18166 from demeritcowboy/cvv-required
cvv required html attribute should depend on backoffice setting
Eileen McNaughton [Sun, 16 Aug 2020 20:02:50 +0000 (08:02 +1200)]
Merge pull request #18154 from highfalutin/patch-5
Mass SMS: Limit group selection to mailing groups
Matthew Wire [Sun, 16 Aug 2020 17:53:58 +0000 (18:53 +0100)]
Merge pull request #18172 from demeritcowboy/utilsarray-isset
[REF] Update recent replacement for CRM_Utils_Array::value
demeritcowboy [Sun, 16 Aug 2020 13:17:14 +0000 (09:17 -0400)]
deprecate unused functions
demeritcowboy [Sun, 16 Aug 2020 13:25:58 +0000 (09:25 -0400)]
update replacement for utils_array::value
Eileen McNaughton [Sun, 16 Aug 2020 06:29:18 +0000 (18:29 +1200)]
Merge pull request #18165 from civicrm/5.29
5.29
eileen [Sun, 16 Aug 2020 04:23:35 +0000 (16:23 +1200)]
Minor cleanup in test class
Eileen McNaughton [Sun, 16 Aug 2020 04:13:35 +0000 (16:13 +1200)]
Merge pull request #18157 from mattwire/utilsarraycontributionmembership
Replace CRM_Utils_Array::value in contribution/confirm and bao/membership
demeritcowboy [Sun, 16 Aug 2020 02:41:25 +0000 (22:41 -0400)]
element doesn't exist if there's no discounts set
Tom Anderson [Sun, 16 Aug 2020 02:37:36 +0000 (12:07 +0930)]
Check if $post defined before trying to use its field values.
Admin pages (e.g. in a custom plugin) may see $post as undefined. The existing usage to get permalinks for these pages can fill debug logs with PHP Notices.
demeritcowboy [Sun, 16 Aug 2020 01:43:21 +0000 (21:43 -0400)]
required
Seamus Lee [Sun, 16 Aug 2020 01:28:13 +0000 (11:28 +1000)]
Merge pull request #18163 from seamuslee001/5.29
[REF] Remove unnecessary comma
Seamus Lee [Sat, 15 Aug 2020 23:31:54 +0000 (09:31 +1000)]
[REF] Remove unnecessary comma
Seamus Lee [Sat, 15 Aug 2020 23:19:35 +0000 (09:19 +1000)]
Merge pull request #18159 from civicrm/5.29
5.29
Matthew Wire [Sat, 15 Aug 2020 13:45:57 +0000 (14:45 +0100)]
Replace CRM_Utils_Array::value in CRM_Member_BAO_Membership
Seamus Lee [Sat, 15 Aug 2020 20:48:05 +0000 (06:48 +1000)]
Merge pull request #18133 from eileenmcnaughton/utf529
Fix 5.29 (unreleased) regression using temp tables
Matthew Wire [Sat, 15 Aug 2020 13:45:34 +0000 (14:45 +0100)]
Replace CRM_Utils_Array::value in CRM_Contribute_Form_Contribution_Confirm
Matthew Wire [Sat, 15 Aug 2020 09:40:43 +0000 (10:40 +0100)]
Merge pull request #18155 from eileenmcnaughton/member_order
Remove legacy handling for 'fixing' line_item.entity_id
Matthew Wire [Sat, 15 Aug 2020 09:39:21 +0000 (10:39 +0100)]
Merge pull request #18156 from eileenmcnaughton/renew
Remove deprecated code ids['userId']
eileen [Sat, 15 Aug 2020 05:32:55 +0000 (17:32 +1200)]
Remove deprecated code ids['userId']
These lines were deprecated 7 months ago and were pretty edge case to start with
eileen [Sat, 15 Aug 2020 04:52:40 +0000 (16:52 +1200)]
Remove legacy handling for 'fixing' line_item.entity_id
I tried to see what was happening with the test in https://github.com/civicrm/civicrm-core/pull/18113
and spotted that it wasn't using Order.api so the line items were likely wrong. However, once I set
it up to use the Order api I found the code we added back in 2018 to attempt to cope with other code
setting entity_id incorrectly was actually itself setting entity_id incorrectly. The issue
happens when there are 2 Memberships linked to one contribution & the removed code 'decides'
one is wrong and alters it. https://github.com/civicrm/civicrm-core/pull/11816
This line of code throws a deprecation notice - which has not been reported / apparently seen in the last
couple of years so I'm assuming it's not actually doing any good and without removing it this test actually
fails
highfalutin [Sat, 15 Aug 2020 04:15:23 +0000 (21:15 -0700)]
Mass SMS: Limit group selection to mailing groups
To populate the selector for mass SMS recipients, the form calls CRM_Core_PseudoConstant::nestedGroup(). However the function call was missing an argument, so all groups were being returned, not just mailing groups as intended. This PR corrects the mistake.
Seamus Lee [Sat, 15 Aug 2020 02:01:43 +0000 (12:01 +1000)]
Merge pull request #18142 from seamuslee001/ref_space_currency
[REF] Remove usages of CRM_Utils_Money::format that pass in a blank s…
Eileen McNaughton [Sat, 15 Aug 2020 01:27:52 +0000 (13:27 +1200)]
Merge pull request #18148 from civicrm/5.29
5.29
Seamus Lee [Sat, 15 Aug 2020 01:00:10 +0000 (11:00 +1000)]
Merge pull request #18151 from eileenmcnaughton/money
Use more appropriate money format function
Seamus Lee [Fri, 14 Aug 2020 02:03:50 +0000 (12:03 +1000)]
[REF] Remove usages of CRM_Utils_Money::format that pass in a blank space as a currency
Use formatLocaleNumericRoundedForDefaultCurrency instead as that achieves the same result
Eileen McNaughton [Sat, 15 Aug 2020 00:56:41 +0000 (12:56 +1200)]
Merge pull request #18149 from seamuslee001/dev_core_1952
dev/core#1952 Remove uncessary component checking when exporting all …
eileen [Wed, 12 Aug 2020 04:20:38 +0000 (16:20 +1200)]
Fix 5.29 regression using temp tables
I just pushed 5.29rc through our WMF CI & it failed on a situation where it created a temp
table and that got joined on a non-temp table with a collation mix error. The issue is that the
DB default is set to utf8_general_ci (at least on our development DBs) whereas the
civicrm tables are utf8_unicode_ci. Until https://github.com/civicrm/civicrm-core/pull/18012/files
there was a list of permitted matches for db collation but now any 'utf' string matches.
From what I can tell utf8_general_ci is a pretty common collation on drupal DBs and from my tests
it causes problems if not excluded here
eileen [Fri, 14 Aug 2020 23:51:04 +0000 (11:51 +1200)]
Use more appropriate money format function
Seamus Lee [Fri, 14 Aug 2020 23:22:08 +0000 (09:22 +1000)]
dev/core#1952 Remove uncessary component checking when exporting all activities
Seamus Lee [Fri, 14 Aug 2020 23:04:42 +0000 (09:04 +1000)]
Merge pull request #18144 from seamuslee001/dev_core_1953
dev/core#1953 Ensure that Contribution pages do not fail validation o…
Seamus Lee [Fri, 14 Aug 2020 21:09:00 +0000 (07:09 +1000)]
dev/core#1953 Ensure that Contribution pages do not fail validation on credit cards when a zero dollar price is offered
eileen [Mon, 10 Aug 2020 06:23:53 +0000 (18:23 +1200)]
Metadata fix - phone_type_id, location_type_id, gender_id
Seamus Lee [Fri, 14 Aug 2020 02:09:04 +0000 (12:09 +1000)]
Merge pull request #18135 from colemanw/daoVersions
API - Add upgrade-safe checks to ensure table exists before reading
Seamus Lee [Fri, 14 Aug 2020 01:23:05 +0000 (11:23 +1000)]
Merge pull request #18138 from eileenmcnaughton/dao
Deprecate 'trapException' in DAO::executeQuery
Matthew Wire [Thu, 13 Aug 2020 17:16:07 +0000 (18:16 +0100)]
Merge pull request #18139 from totten/master-region-bits
(REF) CRM_Core_Region - Remove unused bits
eileen [Thu, 13 Aug 2020 08:54:26 +0000 (20:54 +1200)]
Deprecate 'trapException' inn DAO::executeQuery
We are pretty heavily moving towards using exceptions so we should deprecate this. It seems the
fillWithSql is just converting the error to an exception so we shouldn't avoid it
Coleman Watts [Thu, 13 Aug 2020 02:01:24 +0000 (22:01 -0400)]
Suppress errors when reading DAO version constants
Coleman Watts [Wed, 12 Aug 2020 20:58:55 +0000 (16:58 -0400)]
DAO - only check version on fields from core tables
Coleman Watts [Wed, 12 Aug 2020 20:50:32 +0000 (16:50 -0400)]
Log warning when attempting to access nonexistant table from api
Coleman Watts [Wed, 12 Aug 2020 18:50:37 +0000 (14:50 -0400)]
Cleanup CRM_Utils_Check version safeguard with APIv4
Coleman Watts [Wed, 12 Aug 2020 15:44:39 +0000 (11:44 -0400)]
Early return during APIv4::get if table doesn't exist
If there are pending upgrades, checks if table exists before attempting to read from it.