Commit graph

2552 commits

Author SHA1 Message Date
Jeremy Benoist
4dd380b7dd
Fix test following 2.5 merge into master 2023-04-24 14:46:40 +02:00
Jeremy Benoist
66b7bdd07c
Merge remote-tracking branch 'origin/2.5.x' 2023-04-24 14:36:32 +02:00
Casper Meijn
5a5148707c Fix API allowed_registration
Two configuration options need to be enabled to allow user registration via the API:
1) fosuser_registration, which indicates whether registration is allowed at all (frontend and API)
2) api_user_registration, which indicates whether registration is allowed via the API
2023-03-28 20:12:55 +02:00
Jérémy
1003e8f074
Deleted translation using Weblate (English (United States)) 2023-03-27 12:10:09 +02:00
Jérémy Benoist
268372dbbd
Merge pull request #6289 from wallabag/2.5/fix-csrf-user-deletion
Fix CSRF on user deletion
2023-02-07 21:52:51 +01:00
Jérémy Benoist
4e023bddc3
Merge pull request #6288 from wallabag/2.5/xss-username-share-page
Fix XSS on username on share page
2023-02-07 21:43:04 +01:00
Jeremy Benoist
f1b3d5cdd7
Fix CSRF on user deletion 2023-02-07 21:41:52 +01:00
Jeremy Benoist
242e3feac9
Fix adding tag to entries from other people
I've also limited tag length to 20 chars (and limit adding more than 5 tags at once)
2023-02-07 21:25:57 +01:00
Jeremy Benoist
bd4c71682e
Fix XSS on username on share page 2023-02-07 19:58:06 +01:00
Jeremy Benoist
b795622f06
Prepare 2.5.3 2023-02-01 09:51:02 +01:00
Jérémy Benoist
5ac6b6bff9
Merge pull request from GHSA-mrqx-mjc4-vfh3
AnnotationController: fix improper authorization vulnerability
2023-02-01 09:32:22 +01:00
Kevin Decherf
3ed7f2b751 AnnotationController: fix improper authorization vulnerability
This PR is based on 2.5.x branch.

We fix the improper authorization by retrieving the annotation using id
and user id.

We also replace the ParamConverter used to get the requested Annotation
on put and delete actions with an explicit call to AnnotationRepository
in order to prevent a resource enumeration through response discrepancy.

Fixes GHSA-mrqx-mjc4-vfh3

Co-authored-by: Jeremy Benoist <jeremy.benoist@gmail.com>
Signed-off-by: Kevin Decherf <kevin@kdecherf.com>
2023-01-27 23:34:14 +01:00
Wynton Franklin
baddc525bb fix for config links 2023-01-23 18:19:49 -04:00
Kevin Decherf
0fdd9aa991 ExportController: fix improper authorization vulnerability
We fix the improper authorization by duplicating the check done by
the private method EntryController::checkUserAction().

We also replace the ParamConverter used to get the requested Entry with
an explicit call to EntryRepository in order to prevent a resource
enumeration through response discrepancy. Thus, we get the same
exception whether the requested resource does not exist or is not owned
by the requester.

Fixes GHSA-qwx8-mxxx-mg96

Signed-off-by: Kevin Decherf <kevin@kdecherf.com>
2023-01-20 15:09:38 +01:00
Kevin Decherf
2f2cfa2c2a Add prefix for tag slugs
This should be considered as a temporary fix, we may deprecate tag
slugs in the future.

Fixes #6048

Signed-off-by: Kevin Decherf <kevin@kdecherf.com>
2023-01-11 23:20:13 +01:00
Jérémy Benoist
7625e36b5a
Merge pull request #6182 from caspermeijn/openapi3
Update annotations to OpenApi 3
2023-01-02 10:39:56 +01:00
Casper Meijn
4f9c7a92a1 Update annotations to OpenApi 3
Most of the API annotations are directly converted. The changes in meaning are:
- Parameters "in body" is not supported anymore. These are changed to "in query" or to a request body (depending on the code).
2022-12-23 14:54:55 +01:00
Jérémy Benoist
f04e48fc23
Merge pull request #6171 from wallabag/fix/json-array-dbal-type
Properly handle `json_array` type removal
2022-12-22 16:29:53 +01:00
Jeremy Benoist
cdd2185063
Properly handle json_array type removal
The `json_array` type was removed from DBAL v3, we should handle it using a migration to avoid error.
I've also added the remove type because we need it during migration.
2022-12-21 11:02:51 +01:00
Jeremy Benoist
0a6e6abdc4
Add RabbitMQConsumerTotalProxy to lazy RabbitMQ services for messages
This is just a simple proxy because we can't lazy load RabbitMQ service just to count number of messages in the queue.
As they are automatically injected in the controller now, we can't lazy load them.

Also forgot to use `AbstractController` in previous PR about _controller as a service_.
2022-12-19 13:23:56 +01:00
Jeremy Benoist
6aca334d53
Move to controller as a service
Mostly using autowiring to inject deps.
The only tricky part was for import because all producer use the same class and have a different alias. So we must write them down in the service definition, autowiring doesn't work in that case.

Usually:
- if a controller has a constructor, it means injected services are at least re-used once in actions
- otherwise, service are injected per action
2022-12-19 10:38:08 +01:00
Jeremy Benoist
67a344c2c6
Update PagerFanta 2022-12-16 12:22:56 +01:00
Jeremy Benoist
b3099f68c5
Update all Doctrine deps
Also update these deps to be compatible with latest Doctrine version:
- `friendsofsymfony/oauth-server-bundle`
- `lexik/form-filter-bundle`
- `dama/doctrine-test-bundle`
2022-12-16 10:29:42 +01:00
Jérémy Benoist
8f473ecf5c
Merge pull request #6152 from wallabag/fix/container-aware-command
Remove `ContainerAwareCommand` from commands
2022-12-16 10:25:26 +01:00
Jeremy Benoist
32661f380c
Replace SwiftMailer by Symfony Mailer 2022-12-16 10:03:34 +01:00
Jeremy Benoist
5832482a10
Remove ContainerAwareCommand from commands
And use DI to retrieve services in commands (except for `RedisWorkerCommand` where the container is injected, hard to find a better way, at least for now).
2022-12-16 10:02:15 +01:00
Nicolas Lœuillet
9c16dd7bd1
Merge pull request #6154 from wallabag/fix/event-dispatcher
Fix EventDispatcher & events
2022-12-16 08:08:53 +01:00
Jeremy Benoist
d47c208743
Fix EventDispatcer & events
Looks like parameter for the `->dispatch(` have been flipped (event first then event name).
Define events should now extends `Symfony\Contracts\EventDispatcher\Event`
2022-12-15 21:47:31 +01:00
Jeremy Benoist
5e2ad5f8db
Move translations files to /translations
This is a recommendation for Symfony 5
2022-12-15 21:19:41 +01:00
Jeremy Benoist
28abfe264a
Upgrade to Twig 3 2022-12-15 13:44:21 +01:00
Jeremy Benoist
33267f0736
Update to FOSUserBundle 3.1
Also remove some deprecation from Symfony.
Use `LegacyEventDispatcherProxy` to handle Symfony 4 dispatch from FOSUser
2022-12-14 09:42:17 +01:00
Jérémy Benoist
a57c815ddc
Merge pull request #6113 from wallabag/dependabot/composer/friendsofphp/php-cs-fixer-3.4.0
Bump friendsofphp/php-cs-fixer from 2.19.3 to 3.4.0
2022-12-13 10:30:58 +01:00
Jeremy Benoist
de5b138a59
Fix CS 2022-12-13 10:26:51 +01:00
Diego Heras
519e9db94b
Translated using Weblate (Spanish)
Currently translated at 100.0% (576 of 576 strings)
2022-12-12 04:16:51 +01:00
Jeremy Benoist
aa5c7f05b8
Upgrade to Symfony 4.4
- disable autowiring for Event (because the Entry entity was injected)
- rename `getClient()` for test to `getTestClient()` to avoid error while overriding (from `BrowserKitAssertionsTrait`)
2022-11-29 18:01:46 -08:00
Jeremy Benoist
b7dba18cb2
Cleanup 2022-11-23 15:51:33 +01:00
Jeremy Benoist
1d3935fbd3
Remove LiipThemeBundle
As baggy theme was removed and material is the only remaining theme, we don't need a theme switched anymore.
So:
- move all `*.twig` files from the material theme folder to the root
- remove useless translations
2022-11-23 14:52:06 +01:00
Jeremy Benoist
27e788d0be
Re-create all API routes 2022-11-23 12:44:55 +01:00
Jeremy Benoist
b41696fd1c Remove some deprecation 2022-11-22 21:39:34 +01:00
Jérémy Benoist
d1cdae9967
Merge pull request #6062 from caspermeijn/openapi
Switch to Swagger for api documentation
2022-11-16 16:42:11 +01:00
Casper Meijn
470a8575c0 Update to nelmio/api-doc 3.0
Convert ApiDoc to Swagger
2022-11-16 16:10:33 +01:00
Xosé M
a5047aff98
Translated using Weblate (Galician)
Currently translated at 100.0% (579 of 579 strings)
2022-11-10 06:47:01 +01:00
retiolus
e7464867ae
Translated using Weblate (Catalan)
Currently translated at 3.1% (18 of 579 strings)
2022-11-07 04:33:43 +01:00
Milo Ivir
acfbe92640
Translated using Weblate (Croatian)
Currently translated at 100.0% (579 of 579 strings)
2022-11-07 04:33:43 +01:00
Eric
6d9d3f9fd4
Translated using Weblate (Chinese (Simplified))
Currently translated at 100.0% (579 of 579 strings)
2022-11-04 17:00:57 +01:00
Oğuz Ersen
d4d57b4d22
Translated using Weblate (Turkish)
Currently translated at 100.0% (579 of 579 strings)
2022-11-04 17:00:57 +01:00
Matthaiks
bfd6614b2f
Translated using Weblate (Polish)
Currently translated at 100.0% (579 of 579 strings)
2022-11-04 17:00:56 +01:00
retiolus
849e39ec80
Translated using Weblate (Catalan)
Currently translated at 1.3% (8 of 578 strings)
2022-11-03 10:53:21 +01:00
Jeremy Benoist
48803b68d6
Cleanup baggy 2022-11-03 10:35:33 +01:00
Jeremy Benoist
8d3fcd4635
Merge remote-tracking branch 'origin/master' into 2.6.0 2022-11-03 10:30:17 +01:00