fat_free_crm 0.17.3 → 0.19.2

data/Procfile

@@ -1 +1 @@
-web: bundle exec unicorn -p $PORT -c ./config/unicorn.rb
+web: bundle exec puma -C config/puma.rb

data/README.md

@@ -53,7 +53,7 @@ Visit our website at http://www.fatfreecrm.com/
 
 ## System Requirements
 
-* Ruby 2.3+ recommended
+* Ruby 2.4+ recommended
 * MySQL v4.1.1 or later (v5+ is recommended), SQLite v3.4 or later, or Postgres 8.4.8 or later.
 * ImageMagick (optional, only needed if you would like to use avatars)
 
@@ -84,7 +84,7 @@ This is the best way to deploy Fat Free CRM if you need to add plugins or make a
 
 ## Upgrading from previous versions of Fat Free CRM
 
-Please read the [Release Notes](https://github.com/fatfreecrm/fat_free_crm/blob/master/CHANGELOG.md) document for more detailed information on upgrading from previous versions.
+Please read the [Changelog](https://github.com/fatfreecrm/fat_free_crm/blob/master/CHANGELOG.md) document for more detailed information on upgrading from previous versions.
 
 
 ## Resources
@@ -116,15 +116,18 @@ Tests can easily be run by typing 'rake' but please note that they do take a whi
 ## Main contributors
 
 * [Michael Dvorkin (@michaeldv)](https://github.com/michaeldv) - Founding creator
-* [Steve Kenworthy (@steveyken)](https://github.com/steveyken) - Maintainer
-* [Nathan Broadbent (@ndbroadbent)](https://github.com/ndbroadbent)
+* CloCkWeRX
+* johnnyshield
+* DmitryAvramec
+* steveyken
 
-See the [contributors graph](https://github.com/fatfreecrm/fat_free_crm/graphs/contributors) and the [contributors file](https://github.com/fatfreecrm/fat_free_crm/blob/master/CONTRIBUTORS) for further details.
+
+See the [contributors graph](https://github.com/fatfreecrm/fat_free_crm/graphs/contributors) and the [contributors file](https://github.com/fatfreecrm/fat_free_crm/blob/master/CONTRIBUTORS.md) for further details.
 
 ## License
 
 Fat Free CRM
-Copyright (c) 2008-2014 Michael Dvorkin and contributors.
+Copyright (c) 2008-2018 Michael Dvorkin and contributors.
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

data/Rakefile

@@ -4,7 +4,7 @@
 # Add your own tasks in files placed in lib/tasks ending in .rake,
 # for example lib/tasks/capistrano.rake, and they will automatically be available to Rake.
 
-require File.expand_path('../config/application', __FILE__)
+require File.expand_path('config/application', __dir__)
 
 FatFreeCRM::Application.load_tasks
 

data/app/assets/javascripts/crm.js.coffee

@@ -374,9 +374,9 @@
         source: (request, response) =>
           request = {auto_complete_query: request['term'], related: related}
           $.get @base_url + "/" + controller + "/auto_complete.json", request, (data) ->
-            response $.map(data, (value, key) ->
-              label: value
-              value: key
+            response $.map(data.results, (value) ->
+              label: value.text
+              value: value.id
             )
 
         # Attach to related asset.

data/app/assets/javascripts/crm_select2.js.coffee

@@ -11,22 +11,23 @@
 
   crm.make_select2 = ->
     $(".select2").not(".select2-container, .select2-offscreen, .select2-hidden-accessible").each ->
-
-      #$(".select2").each ->
-        if $(this).data("url")
-          $(this).select2 
-            'width':'resolve'
-            placeholder: $(this).attr("placeholder")
-            ajax:
-              url: $(this).data("url")
-              dataType: 'json'
-        else
-          $(this).select2 
-            'width':'resolve'
-            placeholder: $(this).attr("placeholder")
+      if $(this).data("url")
+        $(this).select2
+          'width':'resolve'
+          placeholder: $(this).attr("placeholder")
+          ajax:
+            url: $(this).data("url")
+            dataType: 'json'
+      else
+        $(this).select2
+          'width':'resolve'
+          placeholder: $(this).attr("placeholder")
+
+      if $(this).prop("disabled") == true
+        $(this).next('.select2-container').disable()
+        $(this).next('.select2-container').hide()    
 
     $(".select2_tag").not(".select2-container, .select2-offscreen").each ->
-    #$(".select2_tag").each ->
       $(this).select2
         'width':'resolve'
         placeholder: $(this).data("placeholder")

data/app/assets/stylesheets/common.scss

@@ -89,7 +89,7 @@ $sidebar_width: 210px;
   -moz-box-shadow: 5px 5px 15px #bbbbbb, -5px 0px 15px #bbbbbb;
   -webkit-border-radius: 6px;
   -webkit-box-shadow: 5px 5px 15px #bbbbbb, -5px 0px 15px #bbbbbb;
-  input[type="text"], input[type="password"] {
+  input[type="text"], input[type="email"], input[type="password"] {
     font-size: 16px;
     padding: 2px;
     width: 355px; }

data/app/controllers/admin/application_controller.rb

@@ -23,7 +23,7 @@ class Admin::ApplicationController < ApplicationController
 
   #----------------------------------------------------------------------------
   def require_admin_user
-    require_user
+    authenticate_user!
     unless current_user&.admin?
       flash[:notice] = t(:msg_require_admin)
       redirect_to root_path

data/app/controllers/admin/field_groups_controller.rb

@@ -22,9 +22,7 @@ class Admin::FieldGroupsController < Admin::ApplicationController
   def edit
     @field_group = FieldGroup.find(params[:id])
 
-    if params[:previous].to_s =~ /(\d+)\z/
-      @previous = FieldGroup.find_by_id(Regexp.last_match[1]) || Regexp.last_match[1].to_i
-    end
+    @previous = FieldGroup.find_by_id(Regexp.last_match[1]) || Regexp.last_match[1].to_i if params[:previous].to_s =~ /(\d+)\z/
 
     respond_with(@field_group)
   end
@@ -80,6 +78,13 @@ class Admin::FieldGroupsController < Admin::ApplicationController
   protected
 
   def field_group_params
-    params[:field_group].permit!
+    params.require(:field_group).permit(
+      :name,
+      :label,
+      :position,
+      :hint,
+      :tag_id,
+      :klass_name
+    )
   end
 end

data/app/controllers/admin/fields_controller.rb

@@ -43,10 +43,10 @@ class Admin::FieldsController < Admin::ApplicationController
   def create
     as = field_params[:as]
     @field =
-      if as =~ /pair/
+      if as.match?(/pair/)
         CustomFieldPair.create_pair(params).first
       elsif as.present?
-        klass = Field.lookup_class(as).classify.constantize
+        klass = find_class(Field.lookup_class(as))
         klass.create(field_params)
       else
         Field.new(field_params).tap(&:valid?)
@@ -59,7 +59,7 @@ class Admin::FieldsController < Admin::ApplicationController
   # PUT /fields/1.xml                                                    AJAX
   #----------------------------------------------------------------------------
   def update
-    if field_params[:as] =~ /pair/
+    if field_params[:as].match?(/pair/)
       @field = CustomFieldPair.update_pair(params).first
     else
       @field = Field.find(params[:id])
@@ -102,7 +102,7 @@ class Admin::FieldsController < Admin::ApplicationController
                Field.find(id).tap { |f| f.as = as }
              else
                field_group_id = field[:field_group_id]
-               klass = Field.lookup_class(as).classify.constantize
+               klass = find_class(Field.lookup_class(as))
                klass.new(field_group_id: field_group_id, as: as)
       end
 

data/app/controllers/admin/groups_controller.rb

@@ -62,7 +62,7 @@ class Admin::GroupsController < Admin::ApplicationController
   protected
 
   def group_params
-    params[:group].permit!
+    params.require(:group).permit(:name, user_ids: [])
   end
 
   def setup_current_tab

data/app/controllers/admin/tags_controller.rb

@@ -28,9 +28,7 @@ class Admin::TagsController < Admin::ApplicationController
   # GET /admin/tags/1/edit                                                AJAX
   #----------------------------------------------------------------------------
   def edit
-    if params[:previous].to_s =~ /(\d+)\z/
-      @previous = Tag.find_by_id(Regexp.last_match[1]) || Regexp.last_match[1].to_i
-    end
+    @previous = Tag.find_by_id(Regexp.last_match[1]) || Regexp.last_match[1].to_i if params[:previous].to_s =~ /(\d+)\z/
   end
 
   # POST /admin/tags
@@ -68,7 +66,7 @@ class Admin::TagsController < Admin::ApplicationController
   protected
 
   def tag_params
-    params[:tag].permit!
+    params.require(:tag).permit(:name, :taggings_count)
   end
 
   def setup_current_tab

data/app/controllers/admin/users_controller.rb

@@ -35,9 +35,7 @@ class Admin::UsersController < Admin::ApplicationController
   # GET /admin/users/1/edit                                                AJAX
   #----------------------------------------------------------------------------
   def edit
-    if params[:previous].to_s =~ /(\d+)\z/
-      @previous = User.find_by_id(Regexp.last_match[1]) || Regexp.last_match[1].to_i
-    end
+    @previous = User.find_by_id(Regexp.last_match[1]) || Regexp.last_match[1].to_i if params[:previous].to_s =~ /(\d+)\z/
 
     respond_with(@user)
   end
@@ -48,7 +46,7 @@ class Admin::UsersController < Admin::ApplicationController
   def create
     @user = User.new(user_params)
     @user.suspend_if_needs_approval
-    @user.save_without_session_maintenance
+    @user.save
 
     respond_with(@user)
   end
@@ -59,7 +57,7 @@ class Admin::UsersController < Admin::ApplicationController
   def update
     @user = User.find(params[:id])
     @user.attributes = user_params
-    @user.save_without_session_maintenance
+    @user.save
 
     respond_with(@user)
   end
@@ -74,9 +72,7 @@ class Admin::UsersController < Admin::ApplicationController
   # DELETE /admin/users/1.xml                                              AJAX
   #----------------------------------------------------------------------------
   def destroy
-    unless @user.destroyable?(current_user) && @user.destroy
-      flash[:warning] = t(:msg_cant_delete_user, @user.full_name)
-    end
+    flash[:warning] = t(:msg_cant_delete_user, @user.full_name) unless @user.destroyable?(current_user) && @user.destroy
 
     respond_with(@user)
   end
@@ -107,6 +103,7 @@ class Admin::UsersController < Admin::ApplicationController
 
   def user_params
     return {} unless params[:user]
+
     params[:user][:email].try(:strip!)
     params[:user][:password_confirmation] = nil if params[:user][:password_confirmation].blank?
 

data/app/controllers/application_controller.rb

@@ -8,8 +8,9 @@
 class ApplicationController < ActionController::Base
   protect_from_forgery with: :exception
 
+  before_action :configure_devise_parameters, if: :devise_controller?
+  before_action :authenticate_user!
   before_action :set_paper_trail_whodunnit
-
   before_action :set_context
   before_action :clear_setting_cache
   before_action :cors_preflight_check
@@ -17,7 +18,6 @@ class ApplicationController < ActionController::Base
   after_action { hook(:app_after_filter, self) }
   after_action :cors_set_access_control_headers
 
-  helper_method :current_user_session, :current_user, :can_signup?
   helper_method :called_from_index_page?, :called_from_landing_page?
   helper_method :klass
 
@@ -73,16 +73,17 @@ class ApplicationController < ActionController::Base
   end
 
   #
-  # Takes { :related => 'campaigns/7' } or { :related => '5' }
+  # Takes { related: 'campaigns/7' } or { related: '5' }
   #   and returns array of object ids that should be excluded from search
   #   assumes controller_name is a method on 'related' class that returns a collection
   #----------------------------------------------------------------------------
   def auto_complete_ids_to_exclude(related)
     return [] if related.blank?
     return [related.to_i].compact unless related.index('/')
+
     related_class, id = related.split('/')
     obj = related_class.classify.constantize.find_by_id(id)
-    if obj && obj.respond_to?(controller_name)
+    if obj&.respond_to?(controller_name)
       obj.send(controller_name).map(&:id)
     else
       []
@@ -114,47 +115,6 @@ class ApplicationController < ActionController::Base
     @current_tab = tab
   end
 
-  #----------------------------------------------------------------------------
-  def current_user_session
-    @current_user_session ||= Authentication.find
-    @current_user_session = nil if @current_user_session&.record&.suspended?
-    @current_user_session
-  end
-
-  #----------------------------------------------------------------------------
-  def current_user
-    unless @current_user
-      @current_user = (current_user_session&.record)
-      if @current_user
-        @current_user.set_individual_locale
-        @current_user.set_single_access_token
-      end
-      User.current_user = @current_user
-    end
-    @current_user
-  end
-
-  #----------------------------------------------------------------------------
-  def require_user
-    unless current_user
-      store_location
-      flash[:notice] = t(:msg_login_needed) if request.fullpath != "/"
-      respond_to do |format|
-        format.html { redirect_to login_url }
-        format.js   { render plain: "window.location = '#{login_url}';" }
-      end
-    end
-  end
-
-  #----------------------------------------------------------------------------
-  def require_no_user
-    if current_user
-      store_location
-      flash[:notice] = t(:msg_logout_needed)
-      redirect_to profile_url
-    end
-  end
-
   #----------------------------------------------------------------------------
   def store_location
     session[:return_to] = request.fullpath
@@ -281,4 +241,21 @@ class ApplicationController < ActionController::Base
       render plain: ''
     end
   end
+
+  def configure_devise_parameters
+    devise_parameter_sanitizer.permit(:sign_up) do |user_params|
+      user_params.permit(:username, :email, :password, :password_confirmation)
+    end
+  end
+
+  def find_class(asset)
+    Rails.application.eager_load! unless Rails.application.config.cache_classes
+    classes = ActiveRecord::Base.descendants.map(&:name)
+    find = classes.find { |m| m == asset.classify }
+    if find
+      find.safe_constantize
+    else
+      raise "Unknown resource"
+    end
+  end
 end

data/app/controllers/comments_controller.rb

@@ -6,8 +6,6 @@
 # See MIT-LICENSE file or http://www.opensource.org/licenses/mit-license.php
 #------------------------------------------------------------------------------
 class CommentsController < ApplicationController
-  before_action :require_user
-
   # GET /comments
   # GET /comments.json
   # GET /comments.xml
@@ -15,7 +13,7 @@ class CommentsController < ApplicationController
   def index
     @commentable = extract_commentable_name(params)
     if @commentable
-      @asset = @commentable.classify.constantize.my(current_user).find(params[:"#{@commentable}_id"])
+      @asset = find_class(@commentable).my(current_user).find(params[:"#{@commentable}_id"])
       @comments = @asset.comments.order("created_at DESC")
     end
     respond_with(@comments) do |format|
@@ -35,11 +33,9 @@ class CommentsController < ApplicationController
   def edit
     @comment = Comment.find(params[:id])
 
-    model = @comment.commentable_type
+    model = find_class(@comment.commentable_type)
     id = @comment.commentable_id
-    unless model.constantize.my(current_user).find_by_id(id)
-      respond_to_related_not_found(model.downcase)
-    end
+    respond_to_related_not_found(model.downcase) unless model.my(current_user).find_by_id(id)
   end
 
   # POST /comments
@@ -51,13 +47,13 @@ class CommentsController < ApplicationController
       comment_params.merge(user_id: current_user.id)
     )
     # Make sure commentable object exists and is accessible to the current user.
-    model = @comment.commentable_type
+    model = find_class(@comment.commentable_type)
     id = @comment.commentable_id
-    if model.constantize.my(current_user).find_by_id(id)
+    if model.my(current_user).find_by_id(id)
       @comment.save
       respond_with(@comment)
     else
-      respond_to_related_not_found(model.downcase)
+      respond_to_related_not_found(model.name.downcase)
     end
   end
 
@@ -85,7 +81,16 @@ class CommentsController < ApplicationController
 
   def comment_params
     return {} unless params[:comment]
-    params[:comment].permit!
+
+    params.require(:comment).permit(
+      :user_id,
+      :commentable_type,
+      :commentable_id,
+      :private,
+      :title,
+      :comment,
+      :state
+    )
   end
 
   private

data/{config/initializers/authlogic.rb → app/controllers/confirmations_controller.rb}

@@ -4,5 +4,7 @@
 #
 # Fat Free CRM is freely distributable under the terms of MIT license.
 # See MIT-LICENSE file or http://www.opensource.org/licenses/mit-license.php
-#------------------------------------------------------------------------------
-require 'authlogic'
+class ConfirmationsController < Devise::ConfirmationsController
+  respond_to :html
+  append_view_path 'app/views/devise'
+end