Merge branch 'development' into 3578-prevent-blind-sql-injection

Author: danRosca

DEVELOPMENT_ENVIRONMENT.md

@@ -51,7 +51,7 @@
 - Clone the SORMAS-Project repository and open the project in IntelliJ
 	- make sure the under "File -> Project Structure -> Modules" all the modules (except the android app - this should not be added) are recognized, if not add the modules with +
 - Make sure under "File -> Settings -> Plugins" Glassfish & Ant integrations are enabled (look into the "Installed" tab)
-- Install the Vaadin Designer plugin
+- Install the Vaadin plugin (not the Vaadin Designer plugin!)
 - Make a copy of "build.properties.example" contained in "sormas-base", rename it to "build.properties" and set "glassfish.domain.root" to the location of the sormas domain located in the "glassfish/domains" folder inside your payara installation
 - Run "Maven install" on the sormas-base project
 - Add a Payara server to IntelliJ:

README.md

@@ -27,6 +27,8 @@ SORMAS officially supports and is tested on **Chromium-based browsers** (like Go
 
 #### Is there a ReST API documentation?
 Yes! Please download the [latest release](https://github.com/hzi-braunschweig/SORMAS-Project/releases/latest) and copy the content of /deploy/openapi/sormas-rest.yaml to an editor that generates a visual API documentation (e.g. https://editor.swagger.io/).
+<br/>
+Runtime Swagger documentation of the External Visits Resource (used by external symptom journals such as CLIMEDO or PIA) is also available at ``<<host>>/sormas-rest/visits-external/openapi.json`` or ``<<host>>/sormas-rest/visits-external/openapi.yaml``
 
 <p align="center"><img src="https://user-images.githubusercontent.com/23701005/74659600-ebb8fc00-5194-11ea-836b-a7ca9d682301.png"/></p>
 

sormas-api/pom.xml

@@ -67,6 +67,11 @@
 			<artifactId>simmetrics-core</artifactId>
 		</dependency>
 
+		<dependency>
+			<groupId>org.jsoup</groupId>
+			<artifactId>jsoup</artifactId>
+		</dependency>
+
 	</dependencies>
 
 </project>

sormas-api/src/main/java/de/symeda/sormas/api/caze/CaseDataDto.java

@@ -167,6 +167,10 @@ public class CaseDataDto extends PseudonymizableDto {
 	public static final String END_OF_ISOLATION_REASON = "endOfIsolationReason";
 	public static final String END_OF_ISOLATION_REASON_DETAILS = "endOfIsolationReasonDetails";
 
+	public static final String PROHIBITION_TO_WORK = "prohibitionToWork";
+	public static final String PROHIBITION_TO_WORK_FROM = "prohibitionToWorkFrom";
+	public static final String PROHIBITION_TO_WORK_UNTIL = "prohibitionToWorkUntil";
+
 	// Fields are declared in the order they should appear in the import template
 
 	@Outbreaks
@@ -450,6 +454,13 @@ public class CaseDataDto extends PseudonymizableDto {
 	@SensitiveData
 	private String endOfIsolationReasonDetails;
 
+	@HideForCountriesExcept
+	private YesNoUnknown prohibitionToWork;
+	@HideForCountriesExcept
+	private Date prohibitionToWorkFrom;
+	@HideForCountriesExcept
+	private Date prohibitionToWorkUntil;
+
 	public static CaseDataDto build(PersonReferenceDto person, Disease disease) {
 		return build(person, disease, null);
 	}
@@ -1318,6 +1329,30 @@ public void setSormasToSormasOriginInfo(SormasToSormasOriginInfoDto sormasToSorm
 		this.sormasToSormasOriginInfo = sormasToSormasOriginInfo;
 	}
 
+	public YesNoUnknown getProhibitionToWork() {
+		return prohibitionToWork;
+	}
+
+	public void setProhibitionToWork(YesNoUnknown prohibitionToWork) {
+		this.prohibitionToWork = prohibitionToWork;
+	}
+
+	public Date getProhibitionToWorkFrom() {
+		return prohibitionToWorkFrom;
+	}
+
+	public void setProhibitionToWorkFrom(Date prohibitionToWorkFrom) {
+		this.prohibitionToWorkFrom = prohibitionToWorkFrom;
+	}
+
+	public Date getProhibitionToWorkUntil() {
+		return prohibitionToWorkUntil;
+	}
+
+	public void setProhibitionToWorkUntil(Date prohibitionToWorkUntil) {
+		this.prohibitionToWorkUntil = prohibitionToWorkUntil;
+	}
+
 	public boolean isOwnershipHandedOver() {
 		return ownershipHandedOver;
 	}

sormas-api/src/main/java/de/symeda/sormas/api/caze/CaseExportDto.java

@@ -42,7 +42,6 @@
 import de.symeda.sormas.api.location.LocationDto;
 import de.symeda.sormas.api.person.ApproximateAgeType;
 import de.symeda.sormas.api.person.ApproximateAgeType.ApproximateAgeHelper;
-import de.symeda.sormas.api.person.ArmedForcesRelationType;
 import de.symeda.sormas.api.person.BurialConductor;
 import de.symeda.sormas.api.person.EducationType;
 import de.symeda.sormas.api.person.OccupationType;
@@ -186,7 +185,6 @@ public class CaseExportDto implements Serializable {
 	@SensitiveData
 	private String emailAddress;
 	private String occupationType;
-	private ArmedForcesRelationType armedForcesRelationType;
 	private String educationType;
 	private String travelHistory;
 	private boolean traveled;
@@ -266,7 +264,7 @@ public CaseExportDto(long id, long personId, long personAddressId, long epiDataI
 						 String addressRegion, String addressDistrict, String addressCommunity, String city, String street, String houseNumber, String additionalInformation, String postalCode,
 						 String facility, String facilityUuid, String facilityDetails,
 						 String phone, String phoneOwner, String emailAddress, EducationType educationType, String educationDetails,
-						 OccupationType occupationType, String occupationDetails, ArmedForcesRelationType ArmedForcesRelationType, YesNoUnknown contactWithSourceCaseKnown,
+						 OccupationType occupationType, String occupationDetails, YesNoUnknown contactWithSourceCaseKnown,
 						 //Date onsetDate,
 						 Vaccination vaccination, String vaccinationDoses, Date vaccinationDate,
 						 VaccinationInfoSource vaccinationInfoSource, YesNoUnknown postpartum, Trimester trimester,
@@ -283,7 +281,6 @@ public CaseExportDto(long id, long personId, long personAddressId, long epiDataI
 		this.healthConditionsId = healthConditionsId;
 		this.uuid = uuid;
 		this.epidNumber = epidNumber;
-		this.armedForcesRelationType = ArmedForcesRelationType;
 		this.diseaseFormatted = DiseaseHelper.toString(disease, diseaseDetails);
 		this.disease = disease;
 		this.firstName = firstName;
@@ -336,7 +333,6 @@ public CaseExportDto(long id, long personId, long personAddressId, long epiDataI
 		this.emailAddress = emailAddress;
 		this.educationType = PersonHelper.buildEducationString(educationType, educationDetails);
 		this.occupationType = PersonHelper.buildOccupationString(occupationType, occupationDetails);
-		this.armedForcesRelationType = armedForcesRelationType;
 		this.contactWithSourceCaseKnown = contactWithSourceCaseKnown;
 //		this.onsetDate = onsetDate;
 		this.vaccination = vaccination;
@@ -1003,8 +999,8 @@ public String getPhone() {
 
 	@Order(75)
 	@ExportTarget(caseExportTypes = {
-		CaseExportType.CASE_SURVEILLANCE,
-		CaseExportType.CASE_MANAGEMENT })
+			CaseExportType.CASE_SURVEILLANCE,
+			CaseExportType.CASE_MANAGEMENT })
 	@ExportProperty(PersonDto.EMAIL_ADDRESS)
 	@ExportGroup(ExportGroupType.SENSITIVE)
 	public String getEmailAddress() {
@@ -1036,16 +1032,6 @@ public String getOccupationType() {
 	}
 
 	@Order(78)
-	@ExportTarget(caseExportTypes = {
-		CaseExportType.CASE_SURVEILLANCE,
-		CaseExportType.CASE_MANAGEMENT })
-	@ExportProperty(PersonDto.ARMED_FORCES_RELATION_TYPE)
-	@ExportGroup(ExportGroupType.PERSON)
-	public ArmedForcesRelationType getArmedForcesRelationType() {
-		return armedForcesRelationType;
-	}
-
-	@Order(79)
 	@ExportTarget(caseExportTypes = {
 		CaseExportType.CASE_SURVEILLANCE })
 	@ExportProperty(TRAVELED)
@@ -1058,7 +1044,7 @@ public void setTraveled(boolean traveled) {
 		this.traveled = traveled;
 	}
 
-	@Order(80)
+	@Order(79)
 	@ExportTarget(caseExportTypes = {
 		CaseExportType.CASE_SURVEILLANCE })
 	@ExportProperty(TRAVEL_HISTORY)
@@ -1067,7 +1053,7 @@ public String getTravelHistory() {
 		return travelHistory;
 	}
 
-	@Order(81)
+	@Order(80)
 	@ExportTarget(caseExportTypes = {
 		CaseExportType.CASE_SURVEILLANCE })
 	@ExportProperty(BURIAL_ATTENDED)
@@ -1080,7 +1066,7 @@ public void setBurialAttended(boolean burialAttended) {
 		this.burialAttended = burialAttended;
 	}
 
-	@Order(82)
+	@Order(81)
 	@ExportTarget(caseExportTypes = {
 		CaseExportType.CASE_SURVEILLANCE })
 	@ExportProperty(EpiDataDto.CONTACT_WITH_SOURCE_CASE_KNOWN)
@@ -1532,10 +1518,6 @@ public void setOccupationType(String occupationType) {
 		this.occupationType = occupationType;
 	}
 
-	public void setArmedForcesRelationType(ArmedForcesRelationType armedForcesRelationType) {
-		this.armedForcesRelationType = armedForcesRelationType;
-	}
-
 	public void setTravelHistory(String travelHistory) {
 		this.travelHistory = travelHistory;
 	}

sormas-api/src/main/java/de/symeda/sormas/api/caze/CaseFacade.java

@@ -27,6 +27,8 @@
 import de.symeda.sormas.api.CaseMeasure;
 import de.symeda.sormas.api.Disease;
 import de.symeda.sormas.api.Language;
+import de.symeda.sormas.api.messaging.ManualMessageLogDto;
+import de.symeda.sormas.api.messaging.MessageType;
 import de.symeda.sormas.api.contact.ContactReferenceDto;
 import de.symeda.sormas.api.contact.DashboardQuarantineDataDto;
 import de.symeda.sormas.api.event.EventParticipantReferenceDto;
@@ -175,4 +177,10 @@ List<DashboardQuarantineDataDto> getQuarantineDataForDashBoard(
 		Date to);
 
 	long countCasesConvertedFromContacts(CaseCriteria caseCriteria);
+
+	void sendMessage(List<String> caseUuids, String subject, String messageContent, MessageType... messageTypes);
+
+	long countCasesWithMissingContactInformation(List<String> caseUuids, MessageType messageType);
+
+	List<ManualMessageLogDto> getMessageLog(String caseUuid, MessageType messageType);
 }

sormas-api/src/main/java/de/symeda/sormas/api/caze/CaseIndexDetailedDto.java

@@ -30,6 +30,9 @@ public class CaseIndexDetailedDto extends CaseIndexDto {
 	public static final String LATEST_EVENT_ID = "latestEventId";
 	public static final String LATEST_EVENT_STATUS = "latestEventStatus";
 	public static final String LATEST_EVENT_TITLE = "latestEventTitle";
+	public static final String LATEST_SAMPLE_DATE_TIME = "latestSampleDateTime";
+	public static final String SAMPLE_COUNT = "sampleCount";
+	public static final String SYMPTOM_ONSET_DATE = "symptomOnsetDate";
 
 	@PersonalData
 	@SensitiveData
@@ -53,6 +56,9 @@ public class CaseIndexDetailedDto extends CaseIndexDto {
 	private String latestEventId;
 	private String latestEventTitle;
 	private EventStatus latestEventStatus;
+	private Date latestSampleDateTime;
+	private Long sampleCount;
+	private Date symptomOnsetDate;
 
 	private UserReferenceDto reportingUser;
 
@@ -66,7 +72,8 @@ public CaseIndexDetailedDto(long id, String uuid, String epidNumber, String exte
 								Integer age, ApproximateAgeType ageType, Integer birthdateDD, Integer birthdateMM, Integer birthdateYYYY, Sex sex,
 								Date quarantineTo, Float completeness, FollowUpStatus followUpStatus, Date followUpUntil, Date changeDate, Long facilityId,
 								String city, String street, String houseNumber, String additionalInformation, String postalCode, String phone,
-								String reportingUserFirstName, String reportingUserLastName, int visitCount, long eventCount) {
+								String reportingUserFirstName, String reportingUserLastName, Date symptomOnsetDate, 
+								int visitCount, long eventCount, Date latestSampleDateTime, long sampleCount) {
 
 		super(id, uuid, epidNumber, externalID, personFirstName, personLastName, disease, diseaseDetails, caseClassification, investigationStatus,
 				presentCondition, reportDate, reportingUserUuid, creationDate, regionUuid, districtUuid, districtName, communityUuid,
@@ -83,6 +90,9 @@ public CaseIndexDetailedDto(long id, String uuid, String epidNumber, String exte
 		this.phone = phone;
 		this.reportingUser = new UserReferenceDto(reportingUserUuid, reportingUserFirstName, reportingUserLastName, null);
 		this.eventCount = eventCount;
+		this.latestSampleDateTime = latestSampleDateTime;
+		this.sampleCount = sampleCount;
+		this.symptomOnsetDate = symptomOnsetDate;
 	}
 
 	public String getCity() {
@@ -144,4 +154,16 @@ public EventStatus getLatestEventStatus() {
 	public void setLatestEventStatus(EventStatus latestEventStatus) {
 		this.latestEventStatus = latestEventStatus;
 	}
+
+	public Date getLatestSampleDateTime() {
+		return latestSampleDateTime;
+	}
+
+	public Long getSampleCount() {
+		return sampleCount;
+	}
+
+	public Date getSymptomOnsetDate() {
+		return symptomOnsetDate;
+	}
 }

sormas-api/src/main/java/de/symeda/sormas/api/caze/classification/ClassificationHtmlRenderer.java

@@ -17,14 +17,11 @@
  *******************************************************************************/
 package de.symeda.sormas.api.caze.classification;
 
-import static de.symeda.sormas.api.utils.HtmlHelper.escapeAndUnescapeBasicTags;
-import static de.symeda.sormas.api.utils.HtmlHelper.unescapeBasicTags;
-
 import java.util.Date;
 import java.util.List;
 
 import org.apache.commons.lang3.StringUtils;
-import org.apache.commons.text.StringEscapeUtils;
+import org.jsoup.safety.Whitelist;
 
 import de.symeda.sormas.api.Disease;
 import de.symeda.sormas.api.FacadeProvider;
@@ -34,6 +31,7 @@
 import de.symeda.sormas.api.i18n.Strings;
 import de.symeda.sormas.api.utils.DataHelper;
 import de.symeda.sormas.api.utils.DateHelper;
+import de.symeda.sormas.api.utils.HtmlHelper;
 import de.symeda.sormas.api.utils.InfoProvider;
 
 /**
@@ -176,7 +174,7 @@ public static String createHtmlForDownload(String sormasServerUrl, List<Disease>
 		html.append("<h1 style=\"text-align: center; color: #005A9C;\">").append(I18nProperties.getString(Strings.classificationClassificationRules)).append("</h1>");
 		html.append("<h4 style=\"text-align: center;\">")
 				.append(I18nProperties.getString(Strings.classificationGeneratedFor))
-				.append(" ").append(StringEscapeUtils.escapeHtml4(InfoProvider.get().getVersion()))
+				.append(" ").append(HtmlHelper.cleanHtml(InfoProvider.get().getVersion()))
 				.append(StringUtils.wrap(I18nProperties.getString(Strings.on), " "))
 				.append(sormasServerUrl).append(StringUtils.wrap(I18nProperties.getString(Strings.at), " "))
 				.append(DateHelper.formatLocalDateTime(new Date(), language)).append("</h4>");
@@ -241,7 +239,7 @@ private static String buildSubCriteriaDiv(
 		for (ClassificationCriteriaDto subCriteria : ((ClassificationCollectiveCriteria) criteria).getSubCriteria()) {
 			if (!(subCriteria instanceof ClassificationCollectiveCriteria) || subCriteria instanceof ClassificationCompactCriteria) {
 				// For non-collective or compact collective criteria, add the description as a list item
-				subCriteriaSb.append("- " + escapeAndUnescapeBasicTags(subCriteria.buildDescription() + "</br>"));
+				subCriteriaSb.append("- " + HtmlHelper.cleanHtml(subCriteria.buildDescription(), Whitelist.basic()) + "</br>");
 			} else if (subCriteria instanceof ClassificationCollectiveCriteria
 				&& !(subCriteria instanceof ClassificationAllOfCriteriaDto)
 				&& !(subCriteria.getClass() == ClassificationXOfCriteriaDto.class)) {
@@ -273,7 +271,7 @@ private static String createSurroundingDiv(ClassificationCriteriaType criteriaTy
 		//@formatter:off
 		return "<div class='classification-rules'>"
 				+ "<div class='main-criteria main-criteria-"
-				+ StringEscapeUtils.escapeHtml4(criteriaType.toString())
+				+ HtmlHelper.cleanHtml(criteriaType.toString())
 				+ "'>"
 				+ content
 				+ "</div></div>";
@@ -287,7 +285,7 @@ private static String createHeadlineDiv(String headline) {
 
 		//@formatter:off
 		return "<div class='headline'>"
-				+ StringEscapeUtils.escapeHtml4(headline)
+				+ HtmlHelper.cleanHtml(headline, Whitelist.basic())
 				+ "</div>";
 		//@formatter:on
 	}
@@ -296,13 +294,12 @@ private static String createHeadlineDiv(String headline) {
 	 * Creates a div containing an info text.
 	 */
 	private static String createInfoDiv() {
-		return unescapeBasicTags(StringEscapeUtils.escapeHtml4(I18nProperties.getString(Strings.classificationInfoText)));
+		return HtmlHelper.cleanI18nString(I18nProperties.getString(Strings.classificationInfoText));
 	}
 
 	private static String createInfoDiv(int requirementsNumber) {
-		return unescapeBasicTags(
-			StringEscapeUtils.escapeHtml4(
-				String.format(I18nProperties.getString(Strings.classificationInfoNumberText), DataHelper.parseNumberToString(requirementsNumber))));
+		return HtmlHelper.cleanI18nString(
+			String.format(I18nProperties.getString(Strings.classificationInfoNumberText), DataHelper.parseNumberToString(requirementsNumber)));
 	}
 
 	/**
@@ -334,7 +331,7 @@ private static String createSubCriteriaSurroundingDiv(String content) {
 	 * Specific tags are allowed to be contained in i18n strings and are thus unescaped
 	 */
 	private static String createCriteriaItemDiv(String text) {
-		return unescapeBasicTags(StringEscapeUtils.escapeHtml4(text) + "<br>");
+		return (HtmlHelper.cleanHtml(text, Whitelist.basic()) + "<br>");
 	}
 
 	private enum ClassificationCriteriaType {