gina 0.6.4 → 0.6.5

package/framework/{v0.6.4 → v0.6.5}/core/connectors/duckdb/lib/connector.js

@@ -30,7 +30,7 @@ var inherits     = lib.inherits;
  * }
  *
  * `database` names the logical model directory (`models/<database>/entities/`).
- * `file` is the actual DuckDB file path. Defaults to `~/.gina/{version}/{database}.duckdb`
+ * `file` is the actual DuckDB file path. Defaults to `~/.gina/{database}.duckdb`
  * when absent. Use `':memory:'` for an ephemeral in-process database.
  * `readOnly` opens the database in read-only mode (driver `access_mode: 'READ_ONLY'`) —
  * writes are refused by the engine, and any number of read-only PROCESSES can share
@@ -45,7 +45,7 @@ var inherits     = lib.inherits;
  * @constructor
  * @param {object}  conf             - Connector config from connectors.json
  * @param {string}  conf.database    - Logical database name (models/ directory)
- * @param {string}  [conf.file]      - DuckDB file path (defaults to ~/.gina/{v}/{database}.duckdb; ':memory:' supported)
+ * @param {string}  [conf.file]      - DuckDB file path (defaults to ~/.gina/{database}.duckdb; ':memory:' supported)
  * @param {boolean} [conf.readOnly]  - Open read-only (access_mode READ_ONLY; default false)
  */
 function DuckdbConnector(conf) {
@@ -67,7 +67,7 @@ function DuckdbConnector(conf) {
             return;
         }
 
-        // Resolve file path: conf.file > ~/.gina/{version}/{database}.duckdb
+        // Resolve file path: conf.file > ~/.gina/{database}.duckdb
         // ':memory:' passes through to the driver verbatim.
         var dbFile = conf.file || _(getPath('gina').home + '/' + conf.database + '.duckdb', true);
 

package/framework/{v0.6.4 → v0.6.5}/core/connectors/sqlite/lib/connector.js

@@ -28,14 +28,14 @@ var inherits        = lib.inherits;
  * }
  *
  * `database` names the logical model directory (`models/<database>/entities/`).
- * `file` is the actual SQLite file path. Defaults to `~/.gina/{version}/{database}.sqlite`
+ * `file` is the actual SQLite file path. Defaults to `~/.gina/{database}.sqlite`
  * when absent. Use `':memory:'` for an ephemeral in-process database (tests).
  *
  * @class SqliteConnector
  * @constructor
  * @param {object} conf            - Connector config from connectors.json
  * @param {string} conf.database   - Logical database name (models/ directory)
- * @param {string} [conf.file]     - SQLite file path (defaults to ~/.gina/{v}/{database}.sqlite)
+ * @param {string} [conf.file]     - SQLite file path (defaults to ~/.gina/{database}.sqlite)
  */
 function SqliteConnector(conf) {
     var self = this;
@@ -53,7 +53,7 @@ function SqliteConnector(conf) {
             return;
         }
 
-        // Resolve file path: conf.file > ~/.gina/{version}/{database}.sqlite
+        // Resolve file path: conf.file > ~/.gina/{database}.sqlite
         var dbFile = conf.file || _(getPath('gina').home + '/' + conf.database + '.sqlite', true);
 
         try {

package/framework/{v0.6.4 → v0.6.5}/core/controller/controller.js

@@ -303,6 +303,28 @@ var _defineLazyLocales = function(conf, srcRows) {
 };
 var _isProdScope    = process.env.NODE_SCOPE_IS_PRODUCTION && process.env.NODE_SCOPE_IS_PRODUCTION.toLowerCase() === 'true';
 
+/**
+ * formatAttachmentDisposition
+ *
+ * Builds an `attachment` Content-Disposition value whose `filename`
+ * parameter is emitted as an RFC 6266 quoted-string — `"` and `\` are
+ * backslash-escaped so the value cannot terminate early. A bare token
+ * cannot legally carry spaces, `;` or `,`, and user-supplied document
+ * titles make those the common case; quoting keeps the header conformant
+ * for every filename shape.
+ *
+ * @function formatAttachmentDisposition
+ * @private
+ * @param {string} filename - name the client should save the download as
+ * @returns {string} headerValue - e.g. `attachment; filename="monthly report.pdf"`
+ *
+ * @example
+ *  formatAttachmentDisposition('monthly report.pdf');
+ *  // -> 'attachment; filename="monthly report.pdf"'
+ */
+function formatAttachmentDisposition(filename) {
+    return 'attachment; filename="' + String(filename).replace(/[\\"]/g, '\\$&') + '"';
+}
 
 /**
  * @class SuperController
@@ -3096,6 +3118,9 @@ function SuperController(options) {
      * @param {string} url - eg.: https://upload.wikimedia.org/wikipedia/fr/2/2f/Firefox_Old_Logo.png
      * @param {object} [options]
      *
+     * N.B.: when `options.contentDisposition` is left at its `attachment`
+     * default, the emitted header carries the target filename as an RFC 6266
+     * quoted-string (see `formatAttachmentDisposition`).
      * */
     this.downloadFromURL = async function(url, options, cb) {
 
@@ -3213,7 +3238,7 @@ function SuperController(options) {
             filename = opt.file;
 
         if ( opt.contentDisposition == 'attachment') {
-            opt.contentDisposition += '; filename=' + filename;
+            opt.contentDisposition = formatAttachmentDisposition(filename);
         }
 
         var ext             = filename.match(/\.\w+$/)[0].substring(1)
@@ -3336,8 +3361,10 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
      *      - To avoid this, add to your download link the attribute `data-gina-link`
      *        This will convert the regular HTTP Request to an XML Request
      *
+     * N.B.: the `content-disposition` header carries the file's basename as
+     * an RFC 6266 quoted-string (see `formatAttachmentDisposition`).
+     *
      * @param {string} filename
-     * @param {object} options
      **/
     this.downloadFromLocal = function(filename) {
 
@@ -3359,7 +3386,7 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
 
             contentType = local.options.conf.server.coreConfiguration.mime[ext];
             local.res.setHeader('content-type', contentType);
-            local.res.setHeader('content-disposition', 'attachment; filename=' + file);
+            local.res.setHeader('content-disposition', formatAttachmentDisposition(file));
 
             var filestream = fs.createReadStream(filename);
             filestream.pipe(local.res);

package/framework/{v0.6.4 → v0.6.5}/core/plugins/lib/validator/src/form-validator.js

@@ -1902,7 +1902,12 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
             }
 
 
-            var isValid = ( typeof(this.value) != 'undefined' && this.value != null && this.value != '' && !/^\s+/.test(this.value) ) ? true : false;
+            // was: var isValid = ( typeof(this.value) != 'undefined' && this.value != null && this.value != '' && !/^\s+/.test(this.value) ) ? true : false;
+            // #B245 - the leading anchor alone made ANY leading-whitespace-padded value
+            // read as empty ("  x" was rejected while "x  " passed, and a paired `trim`
+            // healed the data AFTER the error was recorded); emptiness means
+            // whitespace-ONLY, so anchor both ends. All-whitespace still fails.
+            var isValid = ( typeof(this.value) != 'undefined' && this.value != null && this.value != '' && !/^\s+$/.test(this.value) ) ? true : false;
             var errors  = self[this['name']]['errors'] || {};
 
 
@@ -2246,7 +2251,10 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet, culture) {
         self[el]['trim'] = function(isApplicable) {
             if ( typeof(isApplicable) == 'boolean' && isApplicable ) {
                 //if ( typeof(this.value) == 'string' ) {
-                    this.value = this.value.replace(/^\s+|\s+$/, '');
+                    // was: this.value = this.value.replace(/^\s+|\s+$/, '');
+                    // #B245 - without the global flag, replace() rewrote only the FIRST
+                    // match: "  x  " came back "x  " (leading stripped, trailing kept).
+                    this.value = this.value.replace(/^\s+|\s+$/g, '');
                     local.data[this.name] = local.data[this.name] = this.value;
                 //}
                 return self[this.name]