hyrax 2.0.2 → 2.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 8cbba68b87a679def263b2954cefc2f513e98c25
-  data.tar.gz: '07229cce18d1ed0350488029afef7d34a3f56322'
+  metadata.gz: fa5aeb61448a7bb4c3f3e44853a9ab847456ae9f
+  data.tar.gz: e13c7998086b013f8e1dd4717d79171e5fee0891
 SHA512:
-  metadata.gz: 2b7313824660998cd844daee4728874f059b282d03b9db2745dcafff71e93eefb8e9b78f2fd96f27e882c731c9bef7a74a49cfd47cf684bd4dc63cb62aff2d7c
-  data.tar.gz: 469261a45725b10f3b09f77c36f7d56e74c5ca31b630ba48ab4ac7767c6fcc59b1844d891cce6562d8560eebbc16cfd9fae7d736227354efe7a691ae82dd030b
+  metadata.gz: ee5994be411f64cced03b2bdc1204423fe026e396be07cc568f13823ce7fa4a9367214da5ea4be9f10c702e03453a583645b480816c7de215e8375851fc40579
+  data.tar.gz: 779f0003fd4c0a235987ef5f1c594797aeb2523106866120ddd7be27a71e509be01cda3a4a70727d36eb694854562c4542a18da2caf995b803b08e4c47ddc838

data/README.md

@@ -1,7 +1,7 @@
 ![Logo](https://raw.githubusercontent.com/samvera/hyrax/gh-pages/assets/images/hyrax_logo_horizontal_white_background.png)
 
 Code: [![Version](https://badge.fury.io/rb/hyrax.png)](http://badge.fury.io/rb/hyrax)
-[![Build Status](https://travis-ci.org/samvera/hyrax.png?branch=master)](https://travis-ci.org/samvera/hyrax)
+[![Build Status](https://travis-ci.org/samvera/hyrax.png?branch=2.0-stable)](https://travis-ci.org/samvera/hyrax/branches)
 [![Coverage Status](https://coveralls.io/repos/github/samvera/hyrax/badge.svg?branch=master)](https://coveralls.io/github/samvera/hyrax?branch=master)
 [![Code Climate](https://codeclimate.com/github/samvera/hyrax/badges/gpa.svg)](https://codeclimate.com/github/samvera/hyrax)
 [![Dependency Update Status](https://gemnasium.com/samvera/hyrax.png)](https://gemnasium.com/samvera/hyrax)
@@ -63,7 +63,7 @@ The Samvera community is here to help. Please see our [support guide](./.github/
 # Getting started
 
 This document contains instructions specific to setting up an app with __Hyrax
-v2.0.2__. If you are looking for instructions on installing a different
+v2.0.3__. If you are looking for instructions on installing a different
 version, be sure to select the appropriate branch or tag from the drop-down
 menu above.
 
@@ -160,7 +160,7 @@ NOTE: The steps need to be done in order to create a new Hyrax based app.
 Generate a new Rails application using the template.
 
 ```
-rails _5.0.6_ new my_app -m https://raw.githubusercontent.com/samvera/hyrax/v2.0.1/template.rb
+rails _5.0.6_ new my_app -m https://raw.githubusercontent.com/samvera/hyrax/v2.0.3/template.rb
 ```
 
 Generating a new Rails application using Hyrax's template above takes cares of a number of steps for you, including:

data/app/helpers/hyrax/citations_behaviors/formatters/chicago_formatter.rb

@@ -17,11 +17,11 @@ module Hyrax
           end
           # Get Pub Date
           pub_date = setup_pub_date(work)
-          text << " #{pub_date}." unless pub_date.nil?
+          text << " #{whitewash(pub_date)}." unless pub_date.nil?
 
           text << format_title(work.to_s)
           pub_info = setup_pub_info(work, false)
-          text << " #{pub_info}." if pub_info.present?
+          text << " #{whitewash(pub_info)}." if pub_info.present?
           text.html_safe
         end
 
@@ -40,7 +40,7 @@ module Hyrax
           # if for some reason the first author ended with a comma
           text.gsub!(',,', ',')
           text << "." unless text =~ /\.$/
-          text
+          whitewash(text)
         end
         # rubocop:enable Metrics/MethodLength
 
@@ -50,8 +50,15 @@ module Hyrax
           return "" if title_info.blank?
           title_text = chicago_citation_title(title_info)
           title_text << '.' unless title_text =~ /\.$/
+          title_text = whitewash(title_text)
           " <i class=\"citation-title\">#{title_text}</i>"
         end
+
+        private
+
+          def whitewash(text)
+            Loofah.fragment(text.to_s).scrub!(:whitewash).to_s
+          end
       end
     end
   end

data/app/views/_flash_msg.html.erb

@@ -2,7 +2,7 @@
   <% if flash[type].present? %>
     <div class="alert <%= flash_dom_class %> alert-dismissable" role="alert">
       <button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">&times;</span></button>
-      <%= safe_join(Array.wrap(flash[type]).map(&:html_safe), '<br/>'.html_safe) %>
+      <%= sanitize Array.wrap(flash[type]).join(tag(:br)) %>
     </div>
     <% flash.delete(type) %>
   <% end %>

data/app/views/hyrax/batch_edits/edit.html.erb

@@ -2,7 +2,7 @@
 
 <div class="scrollx scrolly fileHeight"> <!-- original values -->
   <h3> <b>Changes will be applied to: (<%= @form.names.size %> works) </b></h3>
-   <%= @form.names.join(", ").html_safe %>
+   <%= sanitize @form.names.join(", ") %>
 </div> <!-- /original values -->
 
 <div >

data/app/views/hyrax/file_sets/_extra_fields_modal.html.erb

@@ -11,7 +11,7 @@
         <h2 id="extraFieldsModal_<%=name %>_Label">Additional <%= label %>(s)</h2>
       </div>
       <div class="modal-body">
-        <%= values.join("<br />").html_safe %>
+        <%= sanitize values.join("<br />") %>
       </div>
       <div class="modal-footer">
         <button class="btn btn-primary" data-dismiss="modal">Close</button>

data/app/views/hyrax/file_sets/_show_characterization_details.html.erb

@@ -1,7 +1,7 @@
 <% @presenter.characterization_metadata.keys.each do |term| %>
   <div>
     <% additional_values = @presenter.secondary_characterization_values(term) %>
-    <%= @presenter.label_for_term(term) %>: <%= @presenter.primary_characterization_values(term).join("<br />").html_safe %>
+    <%= @presenter.label_for_term(term) %>: <%= sanitize @presenter.primary_characterization_values(term).join("<br />") %>
     <% unless additional_values.empty? %>
       <%= render partial: "extra_fields_modal", locals: { name: term, values: additional_values } %>
     <% end %>

data/app/views/hyrax/notifications/_notifications.html.erb

@@ -17,8 +17,8 @@
                 <%= msg.last_message.created_at.to_formatted_s(:long_ordinal) %>
               </relative-time>
             </td>
-            <td><%= msg.last_message.subject.html_safe %></td>
-            <td><%= msg.last_message.body.html_safe %></td>
+            <td><%= sanitize msg.last_message.subject %></td>
+            <td><%= sanitize msg.last_message.body %></td>
             <td>
               <%= link_to hyrax.notification_path(msg.id),
                       class: "itemicon itemtrash",

data/app/views/hyrax/permissions/confirm_access.html.erb

@@ -3,7 +3,7 @@
     <h4>Apply changes to contents?<h4>
   </div>
   <div class="panel-body">
-      <%= I18n.t("hyrax.upload.change_access_message_html", curation_concern: curation_concern).html_safe %>
+      <%= sanitize I18n.t("hyrax.upload.change_access_message_html", curation_concern: curation_concern) %>
   </div>
   <div class="form-actions panel-footer">
     <%= button_to I18n.t("hyrax.upload.change_access_yes_message"), hyrax.copy_access_permission_path(curation_concern), class: 'btn btn-primary' %>

data/app/views/hyrax/stats/file.html.erb

@@ -1,6 +1,6 @@
 <!-- Adapted from jquery-flot examples https://github.com/flot/flot/blob/master/examples/visitors/index.html -->
 <%= javascript_tag do %>
-  var hyrax_item_stats = <%= @stats.to_flot.to_json.html_safe %>;
+  var hyrax_item_stats = <%= raw json_escape @stats.to_flot.to_json %>;
 <% end %>
 
 <%= content_tag :h1, @file_set, class: "lower" %>

data/app/views/hyrax/stats/work.html.erb

@@ -1,6 +1,6 @@
 <!-- Adapted from jquery-flot examples https://github.com/flot/flot/blob/master/examples/visitors/index.html -->
 <%= javascript_tag do %>
-  var hyrax_item_stats = <%= @stats.to_flot.to_json.html_safe %>;
+  var hyrax_item_stats = <%= raw json_escape @stats.to_flot.to_json %>;
 <% end %>
 
 <%= content_tag :h1, @stats, class: "lower" %>

data/app/views/hyrax/users/_activity_log.html.erb

@@ -9,7 +9,7 @@
   <% events.each do |event| %>
     <% next if event[:action].blank? or event[:timestamp].blank? %>
     <tr>
-      <td><%= event[:action].html_safe %></td>
+      <td><%= sanitize event[:action] %></td>
       <% time = Time.zone.at(event[:timestamp].to_i) %>
       <td data-sort="<%= time.getutc.iso8601(5) %>">
         <relative-time datetime="<%= time.getutc.iso8601 %>" title="<%= time.to_formatted_s(:standard) %>">

data/hyrax.gemspec

@@ -60,6 +60,8 @@ EOF
   spec.add_dependency 'jquery-datatables-rails', '~> 3.4'
   spec.add_dependency 'rdf-rdfxml' # controlled vocabulary importer
   spec.add_dependency 'clipboard-rails', '~> 1.5'
+  # Devise 4.5 removes the 'trackable' module, which we depend on
+  spec.add_dependency 'devise', '<= 4.4.99'
   spec.add_dependency 'rails_autolink', '~> 1.1'
   spec.add_dependency 'active_fedora-noid', '~> 2.0', '>= 2.0.2'
   spec.add_dependency 'awesome_nested_set', '~> 3.1'
@@ -78,7 +80,7 @@ EOF
   spec.add_development_dependency 'engine_cart', '~> 1.2'
   spec.add_development_dependency 'mida', '~> 0.3'
   spec.add_development_dependency 'database_cleaner', '~> 1.3'
-  spec.add_development_dependency 'solr_wrapper', '~> 1.1'
+  spec.add_development_dependency 'solr_wrapper', '>= 1.1', '< 3.0'
   spec.add_development_dependency 'fcrepo_wrapper', '~> 0.5', '>= 0.5.1'
   spec.add_development_dependency 'rspec-rails', '~> 3.1'
   spec.add_development_dependency 'rspec-its', '~> 1.1'

data/lib/hyrax/version.rb

@@ -1,3 +1,3 @@
 module Hyrax
-  VERSION = '2.0.2'.freeze
+  VERSION = '2.0.3'.freeze
 end

data/spec/actors/hyrax/actors/file_set_actor_spec.rb

@@ -278,7 +278,7 @@ RSpec.describe Hyrax::Actors::FileSetActor do
         actor.attach_to_work(work)
         expect(work.representative).to eq(file_set)
         expect(work.thumbnail).to eq(file_set)
-        expect { work.reload }.not_to change { [work.representative, work.thumbnail] }
+        expect { work.reload }.not_to change { [work.representative.id, work.thumbnail.id] }
       end
     end
 

data/spec/controllers/hyrax/admin/strategies_controller_spec.rb

@@ -1,14 +1,25 @@
 RSpec.describe Hyrax::Admin::StrategiesController do
   describe "#update" do
     before do
+      # Added when Flipflop bumped to 2.3.2. See also https://github.com/voormedia/flipflop/issues/26
+      Flipflop::FeatureSet.current.instance_variable_set(:@features, original_feature_hash.merge(feature_id => feature))
+
       sign_in user
     end
+
+    after do
+      Flipflop::FeatureSet.current.instance_variable_set(:@features, original_feature_hash)
+    end
+
+    let(:original_feature_hash) { Flipflop::FeatureSet.current.instance_variable_get(:@features) }
     let(:user) { create(:user) }
     let(:strategy) { Flipflop::Strategies::ActiveRecordStrategy.new(class: Hyrax::Feature).key }
+    let(:feature) { double('feature', id: feature_id, key: 'foo') }
+    let(:feature_id) { :my_feature }
 
     context "when not authorized" do
       it "redirects away" do
-        patch :update, params: { feature_id: '123', id: strategy }
+        patch :update, params: { feature_id: feature.id, id: strategy }
         expect(response).to redirect_to root_path
       end
     end
@@ -20,7 +31,7 @@ RSpec.describe Hyrax::Admin::StrategiesController do
       end
 
       it "is successful" do
-        patch :update, params: { feature_id: '123', id: strategy }
+        patch :update, params: { feature_id: feature.id, id: strategy }
         expect(response).to redirect_to Hyrax::Engine.routes.url_helpers.admin_features_path(locale: 'en')
       end
     end

data/spec/helpers/hyrax/citations_behaviors/formatters/chicago_formatter_spec.rb

@@ -0,0 +1,10 @@
+RSpec.describe Hyrax::CitationsBehaviors::Formatters::ChicagoFormatter do
+  subject(:formatter) { described_class.new(:no_context) }
+
+  let(:presenter) { Hyrax::WorkShowPresenter.new(SolrDocument.new(work.to_solr), :no_ability) }
+  let(:work)      { build(:generic_work, title: ['<ScrIPt>prompt("Confirm Password")</sCRIpt>']) }
+
+  it 'sanitizes input' do
+    expect(formatter.format(presenter)).not_to include 'prompt'
+  end
+end

data/template.rb

@@ -1,4 +1,4 @@
-gem 'hyrax', '2.0.2'
+gem 'hyrax', '2.0.3'
 run 'bundle install'
 generate 'hyrax:install', '-f'
 rails_command 'db:migrate'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: hyrax
 version: !ruby/object:Gem::Version
-  version: 2.0.2
+  version: 2.0.3
 platform: ruby
 authors:
 - Justin Coyne
@@ -14,7 +14,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-03-08 00:00:00.000000000 Z
+date: 2018-09-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -422,6 +422,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.5'
+- !ruby/object:Gem::Dependency
+  name: devise
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "<="
+      - !ruby/object:Gem::Version
+        version: 4.4.99
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "<="
+      - !ruby/object:Gem::Version
+        version: 4.4.99
 - !ruby/object:Gem::Dependency
   name: rails_autolink
   requirement: !ruby/object:Gem::Requirement
@@ -674,16 +688,22 @@ dependencies:
   name: solr_wrapper
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '1.1'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '1.1'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3.0'
 - !ruby/object:Gem::Dependency
   name: fcrepo_wrapper
   requirement: !ruby/object:Gem::Requirement
@@ -1890,7 +1910,6 @@ files:
 - app/views/hyrax/users/index.html.erb
 - app/views/hyrax/users/index.json.jbuilder
 - app/views/hyrax/users/show.html.erb
-- app/views/kaminari/blacklight_compact/_paginator.html.erb
 - app/views/layouts/_head_tag_content.html.erb
 - app/views/layouts/dashboard.html.erb
 - app/views/layouts/error.html.erb
@@ -2306,6 +2325,7 @@ files:
 - spec/helpers/hyrax/ability_helper_spec.rb
 - spec/helpers/hyrax/batch_edits_helper_spec.rb
 - spec/helpers/hyrax/charts_helper_spec.rb
+- spec/helpers/hyrax/citations_behaviors/formatters/chicago_formatter_spec.rb
 - spec/helpers/hyrax/collections_helper_spec.rb
 - spec/helpers/hyrax/content_block_helper_spec.rb
 - spec/helpers/hyrax/file_set_helper_spec.rb
@@ -2943,6 +2963,7 @@ test_files:
 - spec/helpers/hyrax/ability_helper_spec.rb
 - spec/helpers/hyrax/batch_edits_helper_spec.rb
 - spec/helpers/hyrax/charts_helper_spec.rb
+- spec/helpers/hyrax/citations_behaviors/formatters/chicago_formatter_spec.rb
 - spec/helpers/hyrax/collections_helper_spec.rb
 - spec/helpers/hyrax/content_block_helper_spec.rb
 - spec/helpers/hyrax/file_set_helper_spec.rb

data/app/views/kaminari/blacklight_compact/_paginator.html.erb

@@ -1,23 +0,0 @@
-<%# This is copied from blacklight-5.5.3/app/views/kaminari/blacklight_compact/_paginator.html.erb
-so we can add a aria-hidden="true" attribute around it. If that gets added into
-Blacklight, this file can be removed
--%>
-<% if total_pages > 1 -%>
-  <%# #render checks if total_pages > 1, so we can't put our fallback
-  in here .. -%>
-  <%= paginator.render do -%>
-    <div aria-hidden="true" class="page_links">
-      <%= prev_page_tag %> |
-      <span class="page_entries">
-        <%= page_entries_info %>
-      </span> |
-      <%= next_page_tag %>
-    </div>
-  <% end -%>
-<% else -%>
-    <div aria-hidden="true" class="page_links">
-      <span class="page_entries">
-        <%= page_entries_info %>
-      </span>
-    </div>
-<% end -%>