apostrophe 4.28.0 → 4.29.0

package/modules/@apostrophecms/login/index.js

@@ -293,68 +293,67 @@ module.exports = {
         },
         ...self.isPasswordResetEnabled() && {
           async resetRequest(req) {
-            const wait = (t = 2000) => Promise.delay(t);
+            const MIN_RESPONSE_TIME = 2000;
+            const startTime = Date.now();
             const site = (req.headers.host || '').replace(/:\d+$/, '');
             const email = self.apos.launder.string(req.body.email);
             if (!email.length) {
               throw self.apos.error('invalid', req.t('apostrophe:loginResetEmailRequired'));
             }
             let user;
-            // error not reported to browser for security reasons
             try {
               user = await self.getPasswordResetUser(req.body.email);
             } catch (e) {
               self.apos.util.error(e);
             }
             if (!user) {
-              await wait();
               self.apos.util.error(
                 `Reset password request error - the user ${email} doesn\`t exist.`
               );
-              return;
-            }
-            if (!user.email) {
-              await wait();
+            } else if (!user.email) {
               self.apos.util.error(
                 `Reset password request error - the user ${user.username} doesn\`t have an email.`
               );
-              return;
-            }
-            const reset = self.apos.util.generateId();
-            user.passwordReset = reset;
-            user.passwordResetAt = new Date();
-            await self.apos.user.update(req, user, { permissions: false });
-            // Fix - missing host in the absoluteUrl results in a panic.
-            let port = (req.headers.host || '').split(':')[1];
-            if (!port || [ '80', '443' ].includes(port)) {
-              port = '';
             } else {
-              port = `:${port}`;
+              const reset = self.apos.util.generateId();
+              user.passwordReset = reset;
+              user.passwordResetAt = new Date();
+              await self.apos.user.update(req, user, { permissions: false });
+              let port = (req.headers.host || '').split(':')[1];
+              if (!port || [ '80', '443' ].includes(port)) {
+                port = '';
+              } else {
+                port = `:${port}`;
+              }
+              const parsed = new URL(
+                req.absoluteUrl,
+                self.apos.baseUrl
+                  ? undefined
+                  : `${req.protocol}://${req.hostname}${port}`
+              );
+              parsed.pathname = self.login();
+              parsed.search = '?';
+              parsed.searchParams.append('reset', reset);
+              parsed.searchParams.append('email', user.email);
+              try {
+                await self.email(req, 'passwordResetEmail', {
+                  user,
+                  url: parsed.toString(),
+                  site
+                }, {
+                  to: user.email,
+                  subject: req.t('apostrophe:passwordResetRequest', { site })
+                });
+              } catch (err) {
+                self.apos.util.error(`Error while sending email to ${user.email}`, err);
+              }
             }
-            const parsed = new URL(
-              req.absoluteUrl,
-              self.apos.baseUrl
-                ? undefined
-                : `${req.protocol}://${req.hostname}${port}`
-            );
-            parsed.pathname = self.login();
-            parsed.search = '?';
-            parsed.searchParams.append('reset', reset);
-            parsed.searchParams.append('email', user.email);
-            try {
-              await self.email(req, 'passwordResetEmail', {
-                user,
-                url: parsed.toString(),
-                site
-              }, {
-                to: user.email,
-                subject: req.t('apostrophe:passwordResetRequest', { site })
-              });
-            } catch (err) {
-              self.apos.util.error(`Error while sending email to ${user.email}`, err);
+            // Pad all paths to a constant minimum duration
+            const elapsed = Date.now() - startTime;
+            if (elapsed < MIN_RESPONSE_TIME) {
+              await Promise.delay(MIN_RESPONSE_TIME - elapsed);
             }
           },
-
           async reset(req) {
             const password = self.apos.launder.string(req.body.password);
             if (!password.length) {

package/modules/@apostrophecms/modal/ui/apos/components/AposDocsManagerToolbar.vue

@@ -158,6 +158,10 @@ export default {
     moduleName: {
       type: String,
       required: true
+    },
+    searchPlaceholder: {
+      type: [ String, Object ],
+      default: null
     }
   },
   emits: [
@@ -173,7 +177,7 @@ export default {
       searchField: {
         field: {
           name: 'search',
-          placeholder: {
+          placeholder: this.searchPlaceholder || {
             key: 'apostrophe:searchDocType',
             type: this.$t(this.labels.plural)
           },
@@ -197,7 +201,7 @@ export default {
       }
     },
     canSelectAll() {
-      return this.displayedItems;
+      return this.displayedItems && (this.batchOperations.length || this.isRelationship);
     },
     canArchive() {
       return this.checkedCount;
@@ -206,6 +210,17 @@ export default {
       return !this.options.noSearch;
     }
   },
+  watch: {
+    batchOperations() {
+      this.computeActiveOperations();
+    },
+    filterValues: {
+      deep: true,
+      handler() {
+        this.computeActiveOperations();
+      }
+    }
+  },
   mounted () {
     this.computeActiveOperations();
     apos.bus.$on('command-menu-manager-select-all', this.selectAll);

package/modules/@apostrophecms/modal/ui/apos/components/AposModal.vue

@@ -100,7 +100,7 @@
                     <slot name="localeDisplay" />
                   </div>
                   <AposLocale
-                    v-else-if="hasBeenLocalized"
+                    v-else-if="hasBeenLocalized && !isCrossLocale"
                     class="apos-modal__locale"
                     :locale="currentLocale"
                   />
@@ -205,7 +205,8 @@ const modalInnerEl = useTemplateRef('modalInnerEl');
 const findPriorityFocusElementRetryMax = ref(3);
 const currentPriorityFocusElementRetry = ref(0);
 const renderingElements = ref(true);
-const currentLocale = ref(store.activeModal?.locale || apos.i18n.locale);
+const currentLocale = computed(() => store.activeModal?.locale || apos.i18n.locale);
+const isCrossLocale = computed(() => store.activeModal?.crossLocale || false);
 const nonDraggableElements = [
   '.apos-input-wrapper',
   '.apos-field--inline-array-field',

package/modules/@apostrophecms/notification/ui/apos/components/AposNotification.vue

@@ -49,6 +49,7 @@
     <button
       v-if="!process"
       class="apos-notification__button"
+      data-apos-test="notification-close"
       @click="close"
     >
       <Close

package/modules/@apostrophecms/page/index.js

@@ -2951,10 +2951,12 @@ database.`);
               _id: null
             });
           } else {
+            // Note that we MUST NOT honor the "project" query builder here
             query.project({
               ...self.options.publicApiProjection,
               cacheInvalidatedAt: 1
             });
+            query.set('publicApiProjection', self.options.publicApiProjection);
           }
         }
         return query;

package/modules/@apostrophecms/piece-type/index.js

@@ -1126,11 +1126,13 @@ module.exports = {
             query.and({
               _id: null
             });
-          } else if (!query.state.project) {
+          } else {
+            // Note that we MUST NOT honor the "project" query builder here
             query.project({
               ...self.options.publicApiProjection,
               cacheInvalidatedAt: 1
             });
+            query.set('publicApiProjection', self.options.publicApiProjection);
           }
         }
         return query;

package/modules/@apostrophecms/piece-type/ui/apos/components/AposDocsManager.vue

@@ -125,6 +125,7 @@
             :headers="headers"
             :options="{
               ...moduleOptions,
+              isRelationship: !!relationshipField,
               disableUnchecked: maxReached(),
               disableUnpublished: disableUnpublished,
               manuallyPublished: manuallyPublished

package/modules/@apostrophecms/piece-type/ui/apos/components/AposDocsManagerDisplay.vue

@@ -3,6 +3,7 @@
     <tbody>
       <tr>
         <th
+          v-if="hasBatchOperations"
           class="apos-table__header"
         />
         <th
@@ -46,6 +47,7 @@
         @mouseout="out(item._id)"
       >
         <td
+          v-if="hasBatchOperations"
           class="apos-table__cell"
         >
           <AposCheckbox
@@ -166,6 +168,9 @@ export default {
     },
     contextMenuOptions() {
       return this.options;
+    },
+    hasBatchOperations() {
+      return this.options.batchOperations?.length > 0 || this.options.isRelationship;
     }
   },
   watch: {