Check for board membership on comments entity event

Signed-off-by: Julius Härtl <jus@bitgrid.net>

CHANGELOG.md

@@ -1,6 +1,17 @@
 # Changelog
 All notable changes to this project will be documented in this file.
 
+## 0.6.6 - 2019-08-01
+
+### Fixed
+- Bump security related dependencies
+
+## 0.6.5 - 2019-07-28
+
+### Fixed
+- Fix attachment upload/delete failures
+- Bump dependencies
+
 ## 0.6.4 - 2019-06-30
 
 ### Fixed

appinfo/info.xml

@@ -17,7 +17,7 @@
 - 🚀 Get your project organized
 
 </description>
-    <version>0.6.4</version>
+    <version>0.6.6</version>
     <licence>agpl</licence>
     <author>Julius Härtl</author>
     <namespace>Deck</namespace>
@@ -36,7 +36,7 @@
         <database min-version="9.4">pgsql</database>
         <database>sqlite</database>
         <database min-version="5.5">mysql</database>
-        <nextcloud min-version="15" max-version="17" />
+        <nextcloud min-version="15" max-version="16" />
     </dependencies>
     <background-jobs>
         <job>OCA\Deck\Cron\DeleteCron</job>

js/package-lock.json

@@ -1500,9 +1500,9 @@
       "dev": true
     },
     "angular": {
-      "version": "1.7.8",
-      "resolved": "https://registry.npmjs.org/angular/-/angular-1.7.8.tgz",
-      "integrity": "sha512-wtef/y4COxM7ZVhddd7JtAAhyYObq9YXKar9tsW7558BImeVYteJiTxCKeJOL45lJ/+7B4wrAC49j8gTFYEthg=="
+      "version": "1.7.9",
+      "resolved": "https://registry.npmjs.org/angular/-/angular-1.7.9.tgz",
+      "integrity": "sha512-5se7ZpcOtu0MBFlzGv5dsM1quQDoDeUTwZrWjGtTNA7O88cD8TEk5IEKCTDa3uECV9XnvKREVUr7du1ACiWGFQ=="
     },
     "angular-animate": {
       "version": "1.7.8",
@@ -5087,9 +5087,9 @@
       }
     },
     "mixin-deep": {
-      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/mixin-deep/-/mixin-deep-1.3.1.tgz",
-      "integrity": "sha512-8ZItLHeEgaqEvd5lYBXfm4EZSFCX29Jb9K+lAHhDKzReKBQKj3R+7NOF6tjqYi9t4oI8VUfaWITJQm86wnXGNQ==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/mixin-deep/-/mixin-deep-1.3.2.tgz",
+      "integrity": "sha512-WRoDn//mXBiJ1H40rqa3vH0toePwSsGb45iInWlTySa+Uu4k3tYUSxa2v1KqAiLtvlrSzaExqS1gtk96A9zvEA==",
       "dev": true,
       "requires": {
         "for-in": "^1.0.2",
@@ -5259,9 +5259,9 @@
       }
     },
     "nextcloud-vue-collections": {
-      "version": "0.5.4",
-      "resolved": "https://registry.npmjs.org/nextcloud-vue-collections/-/nextcloud-vue-collections-0.5.4.tgz",
-      "integrity": "sha512-e2sM1RYtzYWDx54XNey+oZNTdY0b+0g9Wy4EVhMPyJV2G8Cmw0ZUIuplCEHPMLJ1KsQnYtvghYMO9PQBgPlyBA==",
+      "version": "0.5.6",
+      "resolved": "https://registry.npmjs.org/nextcloud-vue-collections/-/nextcloud-vue-collections-0.5.6.tgz",
+      "integrity": "sha512-H26YBZ+YdHD0z0HwyV9iB5mi4+9dMdFKIH0J0vVa++bSkRJuXaTIYPeMYSLHT59DoqWNroFUWWVrGY8NfKD9mA==",
       "requires": {
         "lodash": "^4.17.11",
         "nextcloud-axios": "^0.2.0",
@@ -6251,9 +6251,9 @@
       "dev": true
     },
     "set-value": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/set-value/-/set-value-2.0.0.tgz",
-      "integrity": "sha512-hw0yxk9GT/Hr5yJEYnHNKYXkIA8mVJgd9ditYZCe16ZczcaELYYcfvaXesNACk2O8O0nTiPQcQhGUQj8JLzeeg==",
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/set-value/-/set-value-2.0.1.tgz",
+      "integrity": "sha512-JxHc1weCN68wRY0fhCoXpyK55m/XPHafOmK4UWD7m2CI14GMcFypt4w/0+NV5f/ZMby2F6S2wwA7fgynh9gWSw==",
       "dev": true,
       "requires": {
         "extend-shallow": "^2.0.1",
@@ -7183,38 +7183,15 @@
       "dev": true
     },
     "union-value": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/union-value/-/union-value-1.0.0.tgz",
-      "integrity": "sha1-XHHDTLW61dzr4+oM0IIHulqhrqQ=",
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/union-value/-/union-value-1.0.1.tgz",
+      "integrity": "sha512-tJfXmxMeWYnczCVs7XAEvIV7ieppALdyepWMkHkwciRpZraG/xwT+s2JN8+pr1+8jCRf80FFzvr+MpQeeoF4Xg==",
       "dev": true,
       "requires": {
         "arr-union": "^3.1.0",
         "get-value": "^2.0.6",
         "is-extendable": "^0.1.1",
-        "set-value": "^0.4.3"
-      },
-      "dependencies": {
-        "extend-shallow": {
-          "version": "2.0.1",
-          "resolved": "https://registry.npmjs.org/extend-shallow/-/extend-shallow-2.0.1.tgz",
-          "integrity": "sha1-Ua99YUrZqfYQ6huvu5idaxxWiQ8=",
-          "dev": true,
-          "requires": {
-            "is-extendable": "^0.1.0"
-          }
-        },
-        "set-value": {
-          "version": "0.4.3",
-          "resolved": "https://registry.npmjs.org/set-value/-/set-value-0.4.3.tgz",
-          "integrity": "sha1-fbCPnT0i3H945Trzw79GZuzfzPE=",
-          "dev": true,
-          "requires": {
-            "extend-shallow": "^2.0.1",
-            "is-extendable": "^0.1.1",
-            "is-plain-object": "^2.0.1",
-            "to-object-path": "^0.3.0"
-          }
-        }
+        "set-value": "^2.0.1"
       }
     },
     "uniq": {

js/package.json

@@ -8,7 +8,7 @@
   },
   "dependencies": {
     "@uirouter/angularjs": "^1.0.22",
-    "angular": "^1.7.8",
+    "angular": "^1.7.9",
     "angular-animate": "^1.7.8",
     "angular-file-upload": "^2.5.0",
     "angular-markdown-it": "^0.6.1",
@@ -18,7 +18,7 @@
     "markdown-it-link-target": "^1.0.2",
     "nextcloud-axios": "^0.2.0",
     "nextcloud-vue": "^0.11.4",
-    "nextcloud-vue-collections": "^0.5.4",
+    "nextcloud-vue-collections": "^0.5.6",
     "ng-infinite-scroll": "^1.3.0",
     "ng-sortable": "^1.3.8",
     "ui-select": "^0.19.8",

lib/Activity/ActivityManager.php

@@ -2,6 +2,8 @@
 /**
  * @copyright Copyright (c) 2018 Julius Härtl <jus@bitgrid.net>
  *
+ * @copyright Copyright (c) 2019 Alexandru Puiu <alexpuiu20@yahoo.com>
+ *
  * @author Julius Härtl <jus@bitgrid.net>
  *
  * @license GNU AGPL version 3 or any later version
@@ -384,6 +386,7 @@ class ActivityManager {
 		}
 		if ($subject === self::SUBJECT_CARD_UPDATE_STACKID) {
 			$subjectParams['stackBefore'] = $this->stackMapper->find($additionalParams['before']);
+			$subjectParams['stack'] = $this->stackMapper->find($additionalParams['after']);
 		}
 
 		$subjectParams['author'] = $this->userId;

lib/Activity/DeckProvider.php

@@ -2,6 +2,8 @@
 /**
  * @copyright Copyright (c) 2018 Julius Härtl <jus@bitgrid.net>
  *
+ * @copyright Copyright (c) 2019 Alexandru Puiu <alexpuiu20@yahoo.com>
+ *
  * @author Julius Härtl <jus@bitgrid.net>
  *
  * @license GNU AGPL version 3 or any later version
@@ -342,6 +344,13 @@ class DeckProvider implements IProvider {
 				'name' => $subjectParams['after']
 			];
 		}
+		if (array_key_exists('card', $subjectParams) && $event->getSubject() === ActivityManager::SUBJECT_CARD_UPDATE_TITLE) {
+			$params['card'] = [
+				'type' => 'highlight',
+				'id' => $subjectParams['after'],
+				'name' => $subjectParams['after']
+			];
+		}
 		return $params;
 	}
 

lib/AppInfo/Application.php

@@ -33,6 +33,7 @@ use OCA\Deck\Db\CardMapper;
 use OCA\Deck\Middleware\ExceptionMiddleware;
 use OCA\Deck\Notification\Notifier;
 use OCA\Deck\Service\FullTextSearchService;
+use OCA\Deck\Service\PermissionService;
 use OCP\AppFramework\App;
 use OCP\Collaboration\Resources\IManager;
 use OCP\Comments\CommentsEntityEvent;
@@ -156,13 +157,14 @@ class Application extends App {
 		$this->getContainer()->getServer()->getEventDispatcher()->addListener(CommentsEntityEvent::EVENT_ENTITY, function(CommentsEntityEvent $event) {
 			$event->addEntityCollection('deckCard', function($name) {
 				/** @var CardMapper */
-				$service = $this->getContainer()->query(CardMapper::class);
+				$cardMapper = $this->getContainer()->query(CardMapper::class);
+				$permissionService = $this->getContainer()->query(PermissionService::class);
+
 				try {
-					$service->find((int) $name);
-				} catch (\InvalidArgumentException $e) {
+					return $permissionService->checkPermission($cardMapper, (int) $name, Acl::PERMISSION_READ);
+				} catch (\Exception $e) {
 					return false;
 				}
-				return true;
 			});
 		});
 		$this->registerCommentsEventHandler();

lib/Command/UserExport.php

@@ -88,13 +88,8 @@ class UserExport extends Command {
 
 		$userId = $input->getArgument('user-id');
 
-		$groups = $this->groupManager->getUserGroupIds(
-			$this->userManager->get($userId)
-		);
-		$boards = $this->boardService->findAll([
-			'user' => $userId,
-			'groups' => $groups
-		]);
+		$this->boardService->setUserId($userId);
+		$boards = $this->boardService->findAll();
 
 		$data = [];
 		foreach ($boards as $board) {

lib/Cron/ScheduledNotifications.php

@@ -27,6 +27,8 @@ use OC\BackgroundJob\Job;
 use OCA\Deck\Db\Card;
 use OCA\Deck\Db\CardMapper;
 use OCA\Deck\Notification\NotificationHelper;
+use OCP\AppFramework\Db\DoesNotExistException;
+use OCP\ILogger;
 
 class ScheduledNotifications extends Job {
 
@@ -34,13 +36,17 @@ class ScheduledNotifications extends Job {
 	protected $cardMapper;
 	/** @var NotificationHelper */
 	protected $notificationHelper;
+	/** @var ILogger */
+	protected $logger;
 
 	public function __construct(
 		CardMapper $cardMapper,
-		NotificationHelper $notificationHelper
+		NotificationHelper $notificationHelper,
+		ILogger $logger
 	) {
 		$this->cardMapper = $cardMapper;
 		$this->notificationHelper = $notificationHelper;
+		$this->logger = $logger;
 	}
 
 	/**
@@ -52,8 +58,13 @@ class ScheduledNotifications extends Job {
 		$cards = $this->cardMapper->findOverdue();
 		/** @var Card $card */
 		foreach ($cards as $card) {
-			$this->notificationHelper->sendCardDuedate($card);
+			try {
+				$this->notificationHelper->sendCardDuedate($card);
+			} catch (DoesNotExistException $e) {
+				// Skip if any error occurs
+				$this->logger->debug('Could not create overdue notification for card with id ' . $card->getId());
+			}
 		}
 	}
 
-}
+}

lib/Notification/NotificationHelper.php

@@ -67,6 +67,10 @@ class NotificationHelper {
 		$this->currentUser = $userId;
 	}
 
+	/**
+	 * @param $card
+	 * @throws \OCP\AppFramework\Db\DoesNotExistException
+	 */
 	public function sendCardDuedate($card) {
 		// check if notification has already been sent
 		// ideally notifications should not be deleted once seen by the user so we can

lib/Service/BoardService.php

@@ -98,6 +98,15 @@ class BoardService {
 		$this->userId = $userId;
 	}
 
+	/**
+	 * Set a different user than the current one, e.g. when no user is available in occ
+	 *
+	 * @param string $userId
+	 */
+	public function setUserId(string $userId): void {
+		$this->userId = $userId;
+	}
+
 	/**
 	 * @return array
 	 */

lib/Service/CardService.php

@@ -420,7 +420,7 @@ class CardService {
 			$result[$card->getOrder()] = $card;
 		}
 		$this->changeHelper->cardChanged($id, false);
-		return $result;
+		return array_values($result);
 	}
 
 	/**

lib/Service/PermissionService.php

@@ -234,11 +234,11 @@ class PermissionService {
 			return [];
 		}
 
+		$users = [];
 		$owner = $this->userManager->get($board->getOwner());
 		if ($owner === null) {
 			$this->logger->info('No owner found for board ' . $board->getId());
 		} else {
-			$users = [];
 			$users[$owner->getUID()] = new User($owner);
 		}
 		$acls = $this->aclMapper->findAll($boardId);

lib/Service/StackService.php

@@ -345,7 +345,7 @@ class StackService {
 			throw new BadRequestException('order must be provided');
 		}
 
-		$this->permissionService->checkPermission($this->stackMapper, $id, Acl::PERMISSION_EDIT);
+		$this->permissionService->checkPermission($this->stackMapper, $id, Acl::PERMISSION_MANAGE);
 		$stackToSort = $this->stackMapper->find($id);
 		$stacks = $this->stackMapper->findAll($stackToSort->getBoardId());
 		$result = [];

templates/part.board.headerControls.php

@@ -1,4 +1,4 @@
-<div id="stack-add" ng-if="boardservice.canEdit() && checkCanEdit()">
+<div id="stack-add" ng-if="boardservice.canManage() && checkCanEdit()">
     <form class="ng-pristine ng-valid" ng-submit="createStack()">
         <label for="new-stack-input-<?php p($_['headerControlsId']); ?>" class="hidden-visually"><?php p($l->t('Add a new stack')); ?></label>
         <input type="text" class="no-close" placeholder="<?php p($l->t('Add a new stack')); ?>"

tests/unit/Command/UserExportTest.php

@@ -89,28 +89,12 @@ class UserExportTest extends \Test\TestCase {
 		$input->expects($this->once())->method('getArgument')->with('user-id')->willReturn('admin');
 		$output = $this->createMock(OutputInterface::class);
 
-		$user = $this->createMock(IUser::class);
-		$this->userManager->expects($this->once())
-			->method('get')
-			->with('admin')
-			->willReturn($user);
-
-		$groups = [];
-		$this->groupManager->expects($this->once())
-			->method('getUserGroupIds')
-			->with($user)
-			->willReturn($groups);
-
 		$boards = [
 			$this->getBoard(1),
 			$this->getBoard(2),
 		];
 		$this->boardService->expects($this->once())
 			->method('findAll')
-			->with([
-				'user' => 'admin',
-				'groups' => $groups
-			])
 			->willReturn($boards);
 		$this->boardMapper->expects($this->exactly(count($boards)))
 			->method('find')

tests/unit/Cron/ScheduledNoificationsTest.php

@@ -28,6 +28,7 @@ use OCA\Deck\Db\BoardMapper;
 use OCA\Deck\Db\Card;
 use OCA\Deck\Db\CardMapper;
 use OCA\Deck\Notification\NotificationHelper;
+use OCP\ILogger;
 
 class ScheduledNoificationsTest extends \Test\TestCase {
 
@@ -35,6 +36,8 @@ class ScheduledNoificationsTest extends \Test\TestCase {
 	protected $cardMapper;
 	/** @var NotificationHelper|\PHPUnit\Framework\MockObject\MockObject */
 	protected $notificationHelper;
+	/** @var ILogger|\PHPUnit\Framework\MockObject\MockObject */
+	protected $logger;
 	/** @var ScheduledNotifications */
 	protected $scheduledNotifications;
 
@@ -42,7 +45,8 @@ class ScheduledNoificationsTest extends \Test\TestCase {
 		parent::setUp();
 		$this->cardMapper = $this->createMock(CardMapper::class);
 		$this->notificationHelper = $this->createMock(NotificationHelper::class);
-		$this->scheduledNotifications = new ScheduledNotifications($this->cardMapper, $this->notificationHelper);
+		$this->logger = $this->createMock(ILogger::class);
+		$this->scheduledNotifications = new ScheduledNotifications($this->cardMapper, $this->notificationHelper, $this->logger);
 	}
 
 	public function testDeleteCron() {