Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bug/59374 regression missing commit message comments in work packages after upgrade to 1501 #17594

Open
wants to merge 4 commits into
base: dev
Choose a base branch
from
Open

Bug/59374 regression missing commit message comments in work packages after upgrade to 1501 #17594

wants to merge 4 commits into from

Conversation

jjabari-op
Copy link
Collaborator

@jjabari-op jjabari-op commented Jan 13, 2025 •
edited
Loading

Ticket

59374

What are you trying to accomplish?

  • Revisions (Commits in a referenced repo) are not rendered in the new activity tab
  • this PR brings back this functionalilty

Screenshots

  • Revisions with unmapped user:
image
  • Revisions with mapped user:
image

What approach did you choose and why?

  • the replaced angular activity tab implementation merged journals and revisions/commits (called changesets in our data model)
  • the new primerized implementation only rendered "proper" journals
  • this PR adds the implementation of merging journals and changesets
  • this PR tries to bring back the revision/changeset rendering with as little effort as possible (as this seems to be a niche feature, see comments below)

Open questions/limitations:

  • the replaced angular implementation calculated IDs and therefore links for the changesets as well
  • the implementation in this PR does not calculate IDs for the revisions and thus cannot provide links for these "activities" (see screenshot)
    • in the angular implementation the changesets would have gotten 109 and 110 and the later journals 111 and 112
    • in the primerized implementation, the changesets do not get an ID and the later journals get 109 and 110
    • thus the IDs of activities of older work_packages and the links to them will be broken
  • I cannot recommend to go down the path of adding the complexity in order to get the same ID mechanism as before
  • As far as I understood, this feature is barely used and might be removed in the future - Adding complexity and effort seems not to be appropriate in this context IMO
  • Additionally the polling will not pick up the latest changesets - only after a reload the changesets will be visible

Steps to test locally

  • First, enable the repository module in a project
  • Then go to Project Settings -> Repository
  • Select your repository type (Git/SVN)
  • Fill in the repository URL (e.g. init a git repo right next to the OP folder and enter ../testrepo/.git)
  • Create a commit message, reference a work package using #N (where N is the work package ID)
  • Sync the repo manually in the rails console repo = Repository.first; puts "Found repo: #{repo.inspect}"; repo&.fetch_changesets
    (- Optionally map an OP user (User button in the repo config page))
  • The commit(s) should appear in the work package's activity tab as seen in the attached screenshot

@jjabari-op jjabari-op self-assigned this Jan 13, 2025
@jjabari-op jjabari-op requested a review from akabiru January 13, 2025 17:03
@jjabari-op
Copy link
Collaborator Author

@wielinde I need your feedback on my open questions mentioned above. thank you!

github-advanced-security[bot]
github-advanced-security bot found potential problems Jan 13, 2025
View reviewed changes
app/components/work_packages/activities_tab/journals/revision_component.rb

def render_committer_name(committer)
render(Primer::Beta::Text.new(font_weight: :bold, mr: 1)) do
committer.gsub(%r{<.+@.+>}, "").strip

Check failure

Code scanning / CodeQL

Incomplete multi-character sanitization High

This string may still contain
<script
Loading
, which may cause an HTML element injection vulnerability.

Copilot Autofix AI 5 days ago

To fix the problem, we should ensure that all potentially dangerous HTML tags are removed from the committer string. The best way to achieve this is to use a well-tested sanitization library, such as the sanitize gem, which is designed to handle various edge cases and ensure effective sanitization.

  1. Install the sanitize gem if it is not already included in the project.
  2. Update the render_committer_name method to use the sanitize gem to remove any potentially dangerous HTML tags from the committer string.
Suggested changeset 1
app/components/work_packages/activities_tab/journals/revision_component.rb

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/app/components/work_packages/activities_tab/journals/revision_component.rb b/app/components/work_packages/activities_tab/journals/revision_component.rb
--- a/app/components/work_packages/activities_tab/journals/revision_component.rb
+++ b/app/components/work_packages/activities_tab/journals/revision_component.rb
@@ -1 +1,3 @@
+require 'sanitize'
+
 module WorkPackages
@@ -77,3 +79,3 @@
           render(Primer::Beta::Text.new(font_weight: :bold, mr: 1)) do
-            committer.gsub(%r{<.+@.+>}, "").strip
+            Sanitize.fragment(committer.gsub(%r{<.+@.+>}, "").strip)
           end
EOF
@@ -1 +1,3 @@
require 'sanitize'

module WorkPackages
@@ -77,3 +79,3 @@
render(Primer::Beta::Text.new(font_weight: :bold, mr: 1)) do
committer.gsub(%r{<.+@.+>}, "").strip
Sanitize.fragment(committer.gsub(%r{<.+@.+>}, "").strip)
end
Copilot is powered by AI and may make mistakes. Always verify output.
Positive Feedback
Negative Feedback

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Please select one or more of the options
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jjabari-op - this looks sensible, wdyt?

@jjabari-op
Copy link
Collaborator Author

@akabiru I've added the change requested by Parimal. I would appreciate your feedback when you have some spare minutes. Thank you!

akabiru
akabiru approved these changes Jan 17, 2025
View reviewed changes
Copy link
Member

@akabiru akabiru left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice one @jjabari-op code looks good to me, I did not manage to test against a subversion instance.

If we can resolve https://github.com/opf/openproject/pull/17594/files#r1918204882 before merge, that would be good.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@akabiru akabiru akabiru approved these changes

Assignees

@jjabari-op jjabari-op

Labels
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@jjabari-op @akabiru