fat_free_crm 0.17.3 → 0.19.2

data/CHANGELOG.md

@@ -4,29 +4,115 @@ It does not matter how slowly you go as long as you do not stop.
 First they ignore you, then they laugh at you, then they fight you,
 then you win. –- Mahatma Gandhi
 
-Sat Oct 27, 2018 (0.17.3)
----------------------------------------------------------------------
+Wed May 09, 2021 (0.19.2)
+======
+CVE-2021-22885
+
+Wed Apr 04, 2021 (0.19.1)
+======
+
+Minor gem updates
+
+Wed Apr 04, 2021 (0.19.0)
+======
+
+### Important changes
 
 #### Fixed XSS flaw in tags_helper
 Credit Antonin Steinhauser (asteinhauser) for discovery and responsible disclosure.
 
+#### Devise replaces Authlogic for user authentication
+Ticket #742 replaces Authlogic with the latest Devise (4.3.0) which has wider adoption.
+This change requires a database migration on the User model. Please note:
+ - Most User fields are renamed and can hence be rolled back. Existing Authlogic passwords will continue to work.
+ - Users will be forced logged out. Existing user sessions will not be kept and the fields `persistence_token, single_access_token, perishable_token` will be dropped from the database.
+ - Though the migration is generally safe **we recommend to make a backup of your database** before migrating.
+
+#### Existing OAuth broken
+The Devise change will break any OAuth login plugins which depend on Authlogic.
+You can [configure OAuth for Devise using the guides here](https://github.com/plataformatec/devise/wiki/omniauth:-overview).
+
+#### Login and user-related routes changed
+The login URL routes have been changed to use the defaults of Devise.
+
+#### User mailers changed
+Mailers related to user password reset, etc. are changed to use the defaults of Devise.
+
+#### PaperClip version updated from 5.2.1 to 6.0.0
+PaperClip now only depends on `aws-sdk-s3` instead of `aws-sdk`. For more info see https://github.com/thoughtbot/paperclip/pull/2481.
+Replace the Cocaine gem with Terrapin. https://github.com/thoughtbot/terrapin/ Apart from the namespace change, this is a drop in replacement.
+
+#### Rails 5.2
+The underlying framework is now rails 5.2.*
+
+#### Ruby 2.4 deprecated
+Ruby 2.4 has reached end of life and is no longer activity tested against.
+
+#### Other changes
+ * #794 Fix defect with unpermitted params in advanced search
+ * 2bc6184779a26070496e6f4caefa0cc9ba555d7b Remove broken support for delete links on arrays.
+ * #851 upgrade paper_trail
+ * Security fixes CVE-2019-16109, CVE-2019-16676, CVE-2019-5477, CVE-2019-16892
+ * Dependency updates
+
+
+Sat Apr 21, 2018 (0.18.0)
+---------------------------------------------------------------------
+
+### Important changes
+
+#### Minimum Ruby version
+#665 Support for Ruby 2.3 has been dropped, with test coverage for 2.4 and 2.5 enabled.
+
+#### Swap to FactoryBot
+If you consume fat free crm as an engine and re-use any factories, you'll need to [upgrade to FactoryBot](https://github.com/thoughtbot/factory_bot/blob/4-9-0-stable/UPGRADE_FROM_FACTORY_GIRL.md).
+
+#### Removed methods
+`Lead.update_with_permissions` is removed, use user_ids and group_ids inside attributes instead and call lead.update_with_account_and_lead_counters
+`FatFreeCRM::Permissions.save_with_permissions` is removed, use user_ids and group_ids inside attributes and call save
+`FatFreeCRM::Permissions.update_with_permissions` is removed, use user_ids and group_ids inside attributes and call update_attributes
+
+#### Other changes
+ - CVE-2018-8048 (loofah gem)
+ - CVE-2018-3741 (rails-html-sanitizer gem)
+ - #768 Fix comment creation on entities
+ - #762 #764 Fix bug in select menu
+ - #759 Improve zero revenue display
+ - #753 Opportunities sort by weighted amount
+ - #749 Fix unsafe reflection and mass assignment
+
 Wed Jan 24, 2018 (0.17.2)
 ---------------------------------------------------------------------
- - Fix CVE-2017-0889
- - Fix #687
+ - CVE-2017-0889
+ - #724 Fixes #589 Autocomplete regression
+ - #723 Fixes #687 Passing string to define a callback is not supported.
 
-Mon Jan 22, 2018 (0.16.2)
+Wed Jan 24, 2018 (0.16.3)
 ---------------------------------------------------------------------
- - Fix #687
+CVE-2017-0889
+
+Wed Jan 24, 2018 (0.15.1)
+---------------------------------------------------------------------
+CVE-2017-0889
+
+Wed Jan 24, 2018 (0.14.1)
+---------------------------------------------------------------------
+CVE-2017-0889
 
 Sat Jan 20, 2018 (0.17.1)
 ---------------------------------------------------------------------
  - #709 Revert accidental minimum ruby version 2.4 changes (#665)
+ - Fix #687 Passing string to define a callback is not supported.
+
+Mon Jan 22, 2018 (0.16.2)
+---------------------------------------------------------------------
+Fix #687
 
 Sat Jan 20, 2018 (0.17.0)
 ---------------------------------------------------------------------
 
 ### Important changes
+
 #### Select2 for select boxes
 This release replaces [Chozen](https://harvesthq.github.io/chosen/) with [Select2](https://select2.org/) consistently across the app.
 This may break plugins which rely on Chozen. To fix any issues please

data/CONTRIBUTORS.md

@@ -2,91 +2,134 @@ The following people have contributed code, patches, bug fixes, and language
 translations to the Fat Free CRM:
 
   * Aaron Brethorst
+  * Adis Osmonov ªº
   * Adrian Klingel
-  * Alexander Kabanov (USA)
+  * Ain Tohvri
+  * Alejandro
+  * Aleksander Madland Stapnes
+  * Alexander Kabanov
   * Alex Tomlins
-  * Andrew Neil (United Kingdom)
-  * Apirak Panatkool (Thailand)
-  * Avery Pennarun (Canada)
-  * Beatriz Garcia Parrilla (Spain)
-  * Ben Tillman (Hong Kong)
+  * AndrewsHerrera
+  * Anton Oslyak
+  * Antonin Steinhauser
+  * Apirak
+  * Apirak Panatkool
+  * Ashwin Phatak
+  * Avery Pennarun
+  * Ben Tillman
   * Brook
-  * Cédric Brancourt (France)
+  * Bryan Helmkamp
   * Chris Carter
   * Codemis
-  * Craig Ulliott (USA)
-  * Daniel Jabbour (USA)
-  * Daniel O'Connor (@CloCkWeRX)
+  * Cody Swann
+  * Daniel Jabbour
+  * Daniel O'Connor
+  * Danilo Lacoste
+  * David Chua
   * David Cornu
   * David Keita
-  * Dirk Kelly (Australia)
-  * Dmitry Dudin (Russia)
-  * Douglas Campos (Brasil)
+  * David Westerink
+  * deppbot
+  * Dirk Kelly
+  * DmitriySalko
+  * Dmitry
+  * Dmitry Avramets
+  * Dmitry Dudin
+  * Douglas Campos
   * Drew Neil
-  * Dr. Nic Williams (Australia)
   * dup2
-  * Elad Meidar (Israel)
   * Electron-libre
-  * Enderson Maia (Brasil)
-  * Eric Davis (USA)
-  * Eric Shelley (USA)
-  * Fritz Thielemann (Germany)
-  * Gavin Baker (USA)
+  * Enderson Maia
+  * Eric Shelley
+  * François Koessler
+  * Fritz Thielemann
+  * Gaston Arbeletche -VAIRIX-
+  * Gavin Baker
+  * Grzegorz Unijewski
   * guesxy
-  * Hamish Rickerby (United Kingdom)
-  * Jack Tang (China)
-  * James Zhang (China)
+  * James Cook
+  * James Zhang
   * Jan Schulz-Hofen
-  * Jim Gay (USA)
-  * Johnny Shields (@jonnyshields)
+  * Jim Gay
+  * johnnyshields
+  * Johnny Shields
+  * John W. M. Carneiro
   * Josef Chmel
-  * Jose Luis Gordo Romero (Spain)
+  * jose-gordo
+  * jose.gordo
+  * Jose Luis Gordo
+  * Jose Luis Gordo Romero
   * Joseph Near
-  * Kamil Politowicz (Germany)
+  * Josh Adams
+  * Kamil Politowicz
+  * ken-wong
   * Kevin Fullerton
   * Kiran Jonnalagadda
   * Kouichi Kishikami
-  * Lana Dvorkin (USA)
-  * Leonid Dinershtein (Russia)
-  * Louis Nyffenegger (Australia)
-  * Lukasz Kosewski (Canada)
+  * Koustubh Sinkar
+  * Lana Dvorkin
+  * Lincoln Lee
+  * Louis Nyffenegger
+  * Lukasz Kosewski
+  * m
+  * Malachai
+  * Marcelo M. Leal
   * Marian Mrózek
   * Mark Friedgan
-  * Martin Gajdos (Switzerland)
-  * Martin Trejo (Mexico)
+  * Martin Gajdos
+  * Martin Trejo
+  * Martin Villero
   * Masaki Muranaka
-  * Matt Beedle (Spain)
+  * Matthew Lehner
   * Mauro Alloro
-  * Michael Dvorkin (USA)
-  * Miles Togoe (USA)
-  * Nathan Broadbent (Hong Kong)
+  * Michael Dvorkin
+  * Mike Dvorkin
+  * Murray Steele
+  * Nathan B
+  * Nathan Broadbent
   * Nicholas Fine
-  * Nicholas Rowe (USA)
-  * Nobuhito Okada (Japan)
-  * Olmo Maldonado (USA)
-  * Patrick Mulder (Germany)
+  * Nicholas Rowe
+  * Nicolas Leger
+  * nigh7m4r3
+  * Nobuhito OKADA
+  * Olle Jonsson
+  * Olmo Maldonado
+  * orthographic-pedant
+  * papilip
+  * Patrick Mulder
   * Paul
-  * Peter McCurdy (Canada)
+  * Peter McCurdy
   * Philipp Ullmann
-  * Ralf Ebert (Germany)
+  * Ralf Ebert
+  * Reuben Salagaras
   * rickerbh
-  * Rit Li (USA)
+  * Rit Li
+  * Road Tang
   * Robert Fletcher
   * Rob Esposito
-  * Roman Smirnov (Russia)
-  * Russell Niller (USA)
-  * Ryan Stenhouse (Scotland)
-  * Scott Miller (USA)
+  * Roman Smirnov
+  * Ryan Stenhouse
+  * Satoru Ishikawa
+  * Scott
+  * Scott Dudley
+  * Scott Miller
   * Sebastian Castro
   * Seb Jacobs
   * Serafim Junior Dos Santos Fagundes
-  * Steve Kenworthy (Hong Kong)
+  * Stanley Hansen
+  * Steve Kenworthy
+  * steveyken
+  * Szeto Bo
   * tarbalazs
-  * Todd Makinster (USA)
-  * Tom Meier (Australia)
-  * Trevor Oke (Canada)
+  * Thomas Pike
+  * Tim Adler
+  * Todd Makinster
+  * Tom Meier
+  * Trevor Oke
   * William Lawson
   * Xughaa
-  * Yury Kotlyarov (Russia)
+  * Yann Hourdel
+  * Yury Kotlyarov
+  * Zlatko Zahariev
 
 Generated using "git shortlog -s -n | cut -f 2 | sort"

data/Dockerfile

@@ -1,20 +1,51 @@
 # Usage:
+# docker volume create pgdata
+# docker volume create gems
 # docker-compose up
-# docker-compose exec web bundle exec rake db:create db:schema:load ffcrm:demo:load assets:precompile
+# docker-compose exec web bundle exec rake db:create db:schema:load ffcrm:demo:load
 
-FROM phusion/passenger-ruby24
-MAINTAINER Steve Kenworthy
+FROM ruby:2.4
+
+LABEL author="Steve Kenworthy"
 
 ENV HOME /home/app
 
-ADD . /home/app
-WORKDIR /home/app
-
-RUN apt-get update \
-  && apt-get install -y imagemagick firefox \
-  && apt-get autoremove -y \
-  && cp config/database.postgres.docker.yml config/database.yml \
-  && chown -R app:app /home/app \
-  && rm -f /etc/service/nginx/down /etc/nginx/sites-enabled/default \
-  && cp .docker/nginx/sites-enabled/ffcrm.conf /etc/nginx/sites-enabled/ffcrm.conf \
-  && bundle install --deployment
+RUN mkdir -p $HOME
+
+WORKDIR $HOME
+
+ADD . $HOME
+RUN apt-get update && \
+	apt-get install -y imagemagick tzdata && \
+	apt-get autoremove -y && \
+	cp config/database.postgres.docker.yml config/database.yml && \
+	gem install bundler && \
+	bundle install --deployment && \
+	bundle exec rails assets:precompile
+
+CMD ["bundle","exec","rails","s"]
+
+EXPOSE 3000
+
+# # Usage:
+# # docker volume create pgdata
+# # docker volume create gems
+# # docker-compose up
+# # docker-compose exec web bundle exec rake db:create db:schema:load ffcrm:demo:load assets:precompile
+
+# FROM phusion/passenger-ruby24
+# MAINTAINER Steve Kenworthy
+
+# ENV HOME /home/app
+
+# ADD . /home/app
+# WORKDIR /home/app
+
+# RUN apt-get update \
+#   && apt-get install -y imagemagick firefox tzdata \
+#   && apt-get autoremove -y \
+#   && cp config/database.postgres.docker.yml config/database.yml \
+#   && chown -R app:app /home/app \
+#   && rm -f /etc/service/nginx/down /etc/nginx/sites-enabled/default \
+#   && cp .docker/nginx/sites-enabled/ffcrm.conf /etc/nginx/sites-enabled/ffcrm.conf \
+#   && bundle install --deployment

data/Gemfile

@@ -4,13 +4,17 @@ source 'https://rubygems.org'
 
 # Uncomment the database that you have configured in config/database.yml
 # ----------------------------------------------------------------------
-db_drivers = {
-  "mysql" => "mysql2",
-  "sqlite" => "sqlite3",
-  "postgres" => "pg"
-}
 
-gem db_drivers[ENV['CI'] && ENV['DB']] || 'pg'
+case ENV['CI'] && ENV['DB']
+when 'sqlite'
+  gem 'sqlite3', '~> 1.3.13'
+when 'mysql'
+  gem 'mysql2'
+when 'postgres'
+  gem 'pg'
+else
+  gem 'pg'
+end
 
 # Removes a gem dependency
 def remove(name)
@@ -26,7 +30,7 @@ end
 # Bundler no longer treats runtime dependencies as base dependencies.
 # The following code restores this behaviour.
 # (See https://github.com/carlhuda/bundler/issues/1041)
-spec = Bundler.load_gemspec(File.expand_path("../fat_free_crm.gemspec", __FILE__))
+spec = Bundler.load_gemspec(File.expand_path('fat_free_crm.gemspec', __dir__))
 spec.runtime_dependencies.each do |dep|
   gem dep.name, *dep.requirement.as_list
 end
@@ -40,7 +44,6 @@ remove 'fat_free_crm'
 group :development do
   # don't load these gems in travis
   unless ENV["CI"]
-    gem 'puma'
     gem 'capistrano'
     gem 'capistrano-bundler'
     gem 'capistrano-rails'
@@ -62,26 +65,28 @@ group :development, :test do
   gem 'headless'
   gem 'byebug'
   gem 'pry-rails' unless ENV["CI"]
-  gem 'factory_girl_rails', '~> 4.7.0' # 4.8.0+ stubbed models are not allowed to access the database - User#destroyed?()
-  gem 'rubocop', '~> 0.52.0' # Pinned because upgrades require regenerating rubocop_todo.yml
+  gem 'factory_bot_rails', '~> 5.0' # Was Pinned due to minor failing view tests to 4.0
+  gem 'rubocop', '~> 0.76.0' # Pinned because upgrades require regenerating rubocop_todo.yml
   gem 'rainbow'
+  gem 'puma' # used by capybara 3
 end
 
 group :test do
   gem 'capybara'
   gem 'selenium-webdriver'
-  gem 'chromedriver-helper'
+  gem 'webdrivers'
   gem 'database_cleaner'
-  gem 'acts_as_fu'
   gem 'zeus', platform: :ruby unless ENV["CI"]
   gem 'timecop'
+  gem 'sqlite3', '~> 1.3.13'
 end
 
 group :heroku do
   gem 'rails_12factor'
+  gem 'puma'
 end
 
-gem 'sass-rails'
+gem 'sass-rails', '~> 5.0.3' # sass-rails 6 requires GCC 4.5+
 gem 'coffee-rails'
 gem 'uglifier'
 gem 'execjs'
@@ -89,4 +94,9 @@ gem 'therubyracer', platform: :ruby unless ENV["CI"]
 gem 'nokogiri', '>= 1.8.1'
 gem 'activemodel-serializers-xml'
 gem 'bootsnap', require: false
+gem 'devise', '~>4.6'
+gem 'devise-i18n'
+gem "devise-encryptable"
 gem 'tzinfo-data', platforms: %i[mingw mswin x64_mingw jruby]
+gem 'activejob', '~> 5.2.0'
+gem 'ransack_ui'