Release OpenProject 10.4.1

Gemfile

@@ -165,7 +165,7 @@ gem 'unicorn'
 
 gem 'puma', '~> 4.3.1' # used for development and optionally for production
 
-gem 'nokogiri', '~> 1.10.5'
+gem 'nokogiri', '~> 1.10.8'
 
 gem 'carrierwave', '~> 1.3.1'
 gem 'fog-aws'
@@ -289,6 +289,10 @@ platforms :mri, :mingw, :x64_mingw do
 
   # Support application loading when no database exists yet.
   gem 'activerecord-nulldb-adapter', '~> 0.4.0'
+
+  # Have application level locks on the database to have a mutex shared between workers/hosts.
+  # We e.g. emply this to safeguard the creation of journals.
+  gem 'with_advisory_lock', '~> 4.6.0'
 end
 
 group :opf_plugins do

Gemfile.lock

@@ -649,7 +649,7 @@ GEM
     newrelic_rpm (6.6.0.358)
     nio4r (2.5.2)
     no_proxy_fix (0.1.2)
-    nokogiri (1.10.7)
+    nokogiri (1.10.8)
       mini_portile2 (~> 2.4.0)
     nokogumbo (2.0.1)
       nokogiri (~> 1.8, >= 1.8.4)
@@ -962,6 +962,8 @@ GEM
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.4)
     will_paginate (3.1.8)
+    with_advisory_lock (4.6.0)
+      activerecord (>= 4.2)
     xpath (3.2.0)
       nokogiri (~> 1.8)
     zeitwerk (2.2.2)
@@ -1035,7 +1037,7 @@ DEPENDENCIES
   my_page!
   net-ldap (~> 0.16.0)
   newrelic_rpm
-  nokogiri (~> 1.10.5)
+  nokogiri (~> 1.10.8)
   oj (~> 3.9.1)
   okcomputer (~> 1.18.1)
   omniauth!
@@ -1133,6 +1135,7 @@ DEPENDENCIES
   webdrivers (~> 4.2.0)
   webmock (~> 3.7.2)
   will_paginate (~> 3.1.7)
+  with_advisory_lock (~> 4.6.0)
 
 RUBY VERSION
    ruby 2.6.5p114

app/contracts/attachments/delete_contract.rb

@@ -0,0 +1,37 @@
+#-- encoding: UTF-8
+
+#-- copyright
+# OpenProject is an open source project management software.
+# Copyright (C) 2012-2020 the OpenProject GmbH
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License version 3.
+#
+# OpenProject is a fork of ChiliProject, which is a fork of Redmine. The copyright follows:
+# Copyright (C) 2006-2017 Jean-Philippe Lang
+# Copyright (C) 2010-2013 the ChiliProject Team
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+#
+# See docs/COPYRIGHT.rdoc for more details.
+#++
+
+module Attachments
+  class DeleteContract < ::DeleteContract
+    delete_permission -> {
+      model.deletable?(user)
+    }
+  end
+end

app/contracts/messages/base_contract.rb

@@ -0,0 +1,47 @@
+#-- encoding: UTF-8
+
+#-- copyright
+# OpenProject is an open source project management software.
+# Copyright (C) 2012-2020 the OpenProject GmbH
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License version 3.
+#
+# OpenProject is a fork of ChiliProject, which is a fork of Redmine. The copyright follows:
+# Copyright (C) 2006-2017 Jean-Philippe Lang
+# Copyright (C) 2010-2013 the ChiliProject Team
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+#
+# See docs/COPYRIGHT.rdoc for more details.
+#++
+
+module Messages
+  class BaseContract < ::ModelContract
+    include Attachments::ValidateReplacements
+
+    def self.model
+      Message
+    end
+
+    attribute :forum_id
+    attribute :parent_id
+    attribute :subject
+    attribute :content
+    attribute :last_reply
+    attribute :locked
+    attribute :sticky
+  end
+end

app/contracts/messages/create_contract.rb

@@ -0,0 +1,35 @@
+#-- encoding: UTF-8
+
+#-- copyright
+# OpenProject is an open source project management software.
+# Copyright (C) 2012-2020 the OpenProject GmbH
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License version 3.
+#
+# OpenProject is a fork of ChiliProject, which is a fork of Redmine. The copyright follows:
+# Copyright (C) 2006-2017 Jean-Philippe Lang
+# Copyright (C) 2010-2013 the ChiliProject Team
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+#
+# See docs/COPYRIGHT.rdoc for more details.
+#++
+
+# TODO: This is but a stub
+module Messages
+  class CreateContract < BaseContract
+  end
+end

app/contracts/messages/update_contract.rb

@@ -0,0 +1,35 @@
+#-- encoding: UTF-8
+
+#-- copyright
+# OpenProject is an open source project management software.
+# Copyright (C) 2012-2020 the OpenProject GmbH
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License version 3.
+#
+# OpenProject is a fork of ChiliProject, which is a fork of Redmine. The copyright follows:
+# Copyright (C) 2006-2017 Jean-Philippe Lang
+# Copyright (C) 2010-2013 the ChiliProject Team
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+#
+# See docs/COPYRIGHT.rdoc for more details.
+#++
+
+# TODO: This is but a stub
+module Messages
+  class UpdateContract < BaseContract
+  end
+end

app/controllers/application_controller.rb

@@ -523,14 +523,6 @@ def api_key_from_request
     end
   end
 
-  # Renders a warning flash if obj has unsaved attachments
-  def render_attachment_warning_if_needed(obj)
-    unsaved_attachments = obj.attachments.select(&:new_record?)
-    if unsaved_attachments.any?
-      flash[:warning] = l(:warning_attachments_not_saved, unsaved_attachments.size)
-    end
-  end
-
   # Converts the errors on an ActiveRecord object into a common JSON format
   def object_errors_to_json(object)
     object.errors.map do |attribute, error|

app/controllers/custom_styles_controller.rb

@@ -54,7 +54,7 @@ def create
   end
 
   def update
-    @custom_style = CustomStyle.current
+    @custom_style = get_or_create_custom_style
     if @custom_style.update(custom_style_params)
       redirect_to custom_style_path
     else
@@ -121,7 +121,7 @@ def options_for_theme_select
   end
 
   def set_logo(logo)
-    CustomStyle.current.update(theme_logo: logo)
+    get_or_create_custom_style.update(theme_logo: logo)
   end
 
   def set_colors(variable_params)
@@ -144,10 +144,14 @@ def set_colors(variable_params)
   def set_theme(params)
     theme = ActionController::Parameters.new(theme: params[:theme] || '').permit(:theme)
 
-    @custom_style = CustomStyle.current
+    @custom_style = get_or_create_custom_style
     @custom_style.update(theme)
   end
 
+  def get_or_create_custom_style
+    CustomStyle.current || CustomStyle.create!
+  end
+
   def require_ee_token
     unless EnterpriseToken.allows_to?(:define_custom_style)
       redirect_to custom_style_upsale_path

app/controllers/messages_controller.rb

@@ -56,30 +56,26 @@ def show
                      .page(page)
                      .per_page(per_page_param)
 
-    @reply = Message.new(subject: "RE: #{@message.subject}", parent: @topic)
+    @reply = Message.new(subject: "RE: #{@message.subject}", parent: @topic, forum: @topic.forum)
     render action: 'show', layout: !request.xhr?
   end
 
   # new topic
   def new
-    @message = Message.new.tap do |m|
-      m.author = User.current
-      m.forum = @forum
-    end
+    Messages::SetAttributesService
+      .new(user: current_user,
+           model: Message.new,
+           contract_class: NoopContract)
+      .call(forum: @forum)
+      .result
   end
 
   # Create a new topic
   def create
-    @message = Message.new.tap do |m|
-      m.author = User.current
-      m.forum = @forum
-    end
+    call = create_message(@forum)
+    @message = call.result
 
-    @message.attributes = permitted_params.message(@message)
-    @message.attach_files(permitted_params.attachments.to_h)
-
-    if @message.save
-      render_attachment_warning_if_needed(@message)
+    if call.success?
       call_hook(:controller_messages_new_after_save, params: params, message: @message)
 
       redirect_to topic_path(@message)
@@ -92,15 +88,10 @@ def create
   def reply
     @topic = @message.root
 
-    @reply = Message.new
-    @reply.author = User.current
-    @reply.forum = @forum
-    @reply.attributes = permitted_params.reply
-    @reply.attach_files(permitted_params.attachments.to_h)
+    call = create_reply(@forum, @topic)
+    @reply = call.result
 
-    @topic.children << @reply
-    unless @reply.new_record?
-      render_attachment_warning_if_needed(@reply)
+    if call.success?
       call_hook(:controller_messages_reply_after_save, params: params, message: @reply)
     end
     redirect_to topic_path(@topic, r: @reply)
@@ -109,19 +100,19 @@ def reply
   # Edit a message
   def edit
     return render_403 unless @message.editable_by?(User.current)
+
     @message.attributes = permitted_params.message(@message)
   end
 
   # Edit a message
   def update
+    # TODO: move into contract
     return render_403 unless @message.editable_by?(User.current)
 
-    @message.attributes = permitted_params.message(@message)
-    @message.attach_files(permitted_params.attachments.to_h)
+    call = update_message(@message)
 
-    if @message.save
-      render_attachment_warning_if_needed(@message)
-      flash[:notice] = l(:notice_successful_update)
+    if call.success?
+      flash[:notice] = t(:notice_successful_update)
       @message.reload
       redirect_to topic_path(@message.root, r: (@message.parent_id && @message.id))
     else
@@ -131,9 +122,11 @@ def update
 
   # Delete a messages
   def destroy
+    # TODO: move into contract
     return render_403 unless @message.destroyable_by?(User.current)
+
     @message.destroy
-    flash[:notice] = l(:notice_successful_delete)
+    flash[:notice] = t(:notice_successful_delete)
     redirect_target = if @message.parent.nil?
                         { controller: '/forums', action: 'show', project_id: @project, id: @forum }
                       else
@@ -156,4 +149,38 @@ def quote
       format.any { head :not_acceptable }
     end
   end
+
+  private
+
+  def update_message(message)
+    Messages::UpdateService
+      .new(user: current_user,
+           model: message)
+      .call(permitted_params.message(@project)
+            .merge(attachment_params))
+  end
+
+  def create_message(forum, message_params = permitted_params.message(forum.project))
+    params = message_params
+               .merge(forum: forum)
+               .merge(attachment_params)
+
+    Messages::CreateService
+      .new(user: current_user)
+      .call(params)
+  end
+
+  def create_reply(forum, parent)
+    create_message(forum, permitted_params.reply.merge(parent: parent))
+  end
+
+  def attachment_params
+    attachment_params = permitted_params.attachments.to_h
+
+    if attachment_params.any?
+      { attachment_ids: attachment_params.values.map(&:values).flatten }
+    else
+      {}
+    end
+  end
 end