Merge branch 'develop' into fb_calendar_based_grouping_1209

Author: ankurjuneja

.github/pull_request_template.md

@@ -26,6 +26,7 @@
 import org.jetbrains.annotations.Nullable;
 import org.json.JSONObject;
 import org.labkey.announcements.model.AnnouncementDigestProvider;
+import org.labkey.announcements.model.AnnouncementFullModel;
 import org.labkey.announcements.model.AnnouncementManager;
 import org.labkey.announcements.model.AnnouncementModel;
 import org.labkey.announcements.model.DailyDigestEmailPrefsSelector;
@@ -214,7 +215,6 @@ public static ActionURL getBeginURL(Container c)
 
     public static AnnouncementModel copyEditableProps(AnnouncementModel target, AnnouncementModel source, boolean isInsert)
     {
-        if (source.getApproved() != null) target.setApproved(source.getApproved());
         if (source.getAssignedTo() != null) target.setAssignedTo(source.getAssignedTo());
         if (source.getBody() != null) target.setBody(source.getBody());
         if (source.getExpires() != null) target.setExpires(source.getExpires());
@@ -915,7 +915,7 @@ public BindException bindParameters(PropertyValues m) throws Exception
         public ModelAndView getInsertUpdateView(AnnouncementForm form, boolean reshow, BindException errors)
         {
             Permissions perm = getPermissions();
-            AnnouncementModel parent = null;
+            AnnouncementFullModel parent = null;
             Container c = getContainer();
 
             if (null != form.getParentId())
@@ -2238,7 +2238,7 @@ protected DataRegion getDataRegion(Permissions perm, Settings settings)
 
     public static class ThreadViewBean
     {
-        public AnnouncementModel announcementModel;
+        public AnnouncementFullModel announcementModel;
         public String message = "";
         public Permissions perm = null;
         public boolean isResponse = false;
@@ -2259,7 +2259,7 @@ private ThreadView()
             super("/org/labkey/announcements/announcementThread.jsp", new ThreadViewBean());
         }
 
-        public ThreadView(Container c, ActionURL url, AnnouncementModel ann, Permissions perm)
+        public ThreadView(Container c, ActionURL url, AnnouncementFullModel ann, Permissions perm)
         {
             this();
             init(c, ann, url, perm, true, false);
@@ -2268,11 +2268,11 @@ public ThreadView(Container c, ActionURL url, AnnouncementModel ann, Permissions
         public ThreadView(AnnouncementForm form, Container c, ActionURL url, Permissions perm, boolean print)
         {
             this();
-            AnnouncementModel ann = findThread(c, form.getAsString("rowId"), form.getAsString("entityId"));
+            AnnouncementFullModel ann = findThread(c, form.getAsString("rowId"), form.getAsString("entityId"));
             init(c, ann, url, perm, false, print);
         }
 
-        protected void init(Container c, AnnouncementModel ann, URLHelper currentURL, Permissions perm, boolean isResponse, boolean print)
+        protected void init(Container c, AnnouncementFullModel ann, URLHelper currentURL, Permissions perm, boolean isResponse, boolean print)
         {
             if (null == c || !perm.allowRead(ann))
             {
@@ -2376,7 +2376,7 @@ public AnnouncementModel getAnnouncement()
     }
 
 
-    private static @Nullable AnnouncementModel findThread(Container c, String rowIdVal, String entityId)
+    private static @Nullable AnnouncementFullModel findThread(Container c, String rowIdVal, String entityId)
     {
         int rowId = 0;
         if (rowIdVal != null)

announcements/src/org/labkey/announcements/AnnouncementsController.java

@@ -20,6 +20,7 @@
 <%@ page import="org.labkey.announcements.AnnouncementsController.RespondAction" %>
 <%@ page import="org.labkey.announcements.AnnouncementsController.ThreadView" %>
 <%@ page import="org.labkey.announcements.AnnouncementsController.ThreadViewBean" %>
+<%@ page import="org.labkey.announcements.model.AnnouncementFullModel" %>
 <%@ page import="org.labkey.announcements.model.AnnouncementManager" %>
 <%@ page import="org.labkey.announcements.model.AnnouncementModel" %>
 <%@ page import="org.labkey.announcements.model.Settings" %>
@@ -38,7 +39,7 @@
     Container c = getContainer();
     User user = getUser();
     ThreadViewBean bean = me.getModelBean();
-    AnnouncementModel announcementModel = bean.announcementModel;
+    AnnouncementFullModel announcementModel = bean.announcementModel;
     Settings settings = bean.settings;
 
     if (null == announcementModel)

announcements/src/org/labkey/announcements/announcementThread.jsp

@@ -0,0 +1,23 @@
+package org.labkey.announcements.model;
+
+import java.util.Date;
+
+public class AnnouncementFullModel extends AnnouncementModel
+{
+    private Date _approved = null;
+
+    public Date getApproved()
+    {
+        return _approved;
+    }
+
+    public void setApproved(Date approved)
+    {
+        _approved = approved;
+    }
+
+    public boolean isSpam()
+    {
+        return AnnouncementManager.SPAM_MAGIC_DATE.equals(getApproved());
+    }
+}

announcements/src/org/labkey/announcements/model/AnnouncementFullModel.java

@@ -121,20 +121,20 @@ private AnnouncementManager()
     {
     }
 
-    private static @Nullable AnnouncementModel getAnnouncement(@Nullable Container c, @NotNull SimpleFilter filter)
+    private static @Nullable AnnouncementFullModel getAnnouncement(@Nullable Container c, @NotNull SimpleFilter filter)
     {
         if (c != null)
             filter.addCondition(FieldKey.fromParts("Container"), c);
 
-        return new TableSelector(_comm.getTableInfoAnnouncements(), filter, null).getObject(AnnouncementModel.class);
+        return new TableSelector(_comm.getTableInfoAnnouncements(), filter, null).getObject(AnnouncementFullModel.class);
     }
 
-    public static @Nullable AnnouncementModel getAnnouncement(@Nullable Container c, long rowId)
+    public static @Nullable AnnouncementFullModel getAnnouncement(@Nullable Container c, long rowId)
     {
         return getAnnouncement(c, new SimpleFilter(FieldKey.fromParts("RowId"), rowId));
     }
 
-    public static @Nullable AnnouncementModel getAnnouncement(@Nullable Container c, String entityId)
+    public static @Nullable AnnouncementFullModel getAnnouncement(@Nullable Container c, String entityId)
     {
         try
         {
@@ -522,7 +522,7 @@ private static AnnouncementModel validateModelWithSideEffects(AnnouncementModel
     }
 
     // Magic date value used to mark an announcement that a moderator has reviewed and marked as spam
-    private static final Date SPAM_MAGIC_DATE = new Date(0);
+    static final Date SPAM_MAGIC_DATE = new Date(0);
 
     // Standard filters for retrieving specific classes of messages (approved, spam, needs review)
     public static final SimpleFilter IS_APPROVED_FILTER = new SimpleFilter(FieldKey.fromParts("Approved"), AnnouncementManager.SPAM_MAGIC_DATE, CompareType.GT);
@@ -534,11 +534,6 @@ public static void markAsSpam(Container c, AnnouncementModel ann)
         updateApproved(c, ann, SPAM_MAGIC_DATE);
     }
 
-    public static boolean isSpam(AnnouncementModel ann)
-    {
-        return SPAM_MAGIC_DATE.equals(ann.getApproved());
-    }
-
     // Execute direct SQL (not Table.update())... I don't think we want to change Modified or ModifiedBy. Could consider adding column for Moderator, though.
     // Returns true if an update was made, false if not (e.g., message was already reviewed).
     private static boolean updateApproved(Container c, AnnouncementModel ann, Date date)

announcements/src/org/labkey/announcements/model/AnnouncementManager.java

@@ -80,7 +80,6 @@ public class AnnouncementModel extends Entity implements Serializable
 
     private Collection<AnnouncementModel> _responses = null;
     private Set<User> _authors;
-    private Date _approved = null;
 
     /**
      * Standard constructor.
@@ -418,21 +417,5 @@ public AttachmentParent getAttachmentParent()
     {
         return new AnnouncementAttachmentParent(this);
     }
-
-    public Date getApproved()
-    {
-        return _approved;
-    }
-
-    public void setApproved(Date approved)
-    {
-        _approved = approved;
-    }
-
-    @JsonIgnore
-    public boolean isSpam()
-    {
-        return AnnouncementManager.isSpam(this);
-    }
 }
 

announcements/src/org/labkey/announcements/model/AnnouncementModel.java

@@ -189,6 +189,7 @@
 import org.labkey.api.view.ViewServlet;
 import org.labkey.api.view.WebPartFactory;
 import org.labkey.api.webdav.WebdavResolverImpl;
+import org.labkey.api.wiki.WikiRendererType;
 import org.labkey.api.writer.ContainerUser;
 import org.labkey.filters.ContentSecurityPolicyFilter;
 
@@ -219,6 +220,7 @@ public class ApiModule extends CodeOnlyModule
 
     public static final String EXTJS_3_REQUIRED = "ExtJs3Required";
     public static final String EXTJS_3_API_REQUIRED = "ExtJs3ApiRequired";
+    public static final String ALLOW_MUTATING_SQL_VIA_GET = "AllowMutatingSqlViaGet";
 
     @Override
     protected void init()
@@ -264,6 +266,14 @@ protected void init()
             false,
             FeatureType.Deprecated
         ));
+        OptionalFeatureService.get().addFeatureFlag(new OptionalFeatureFlag(
+            ALLOW_MUTATING_SQL_VIA_GET,
+            "Allow GET requests to execute mutating SQL",
+            "We strongly recommend leaving this off since it bypasses a critical security check (CSRF). This option will be removed in LabKey Server 26.11",
+            false,
+            false,
+            FeatureType.Deprecated
+        ));
     }
 
     @NotNull
@@ -389,6 +399,7 @@ public void registerServlets(ServletContext servletCtx)
             ApiXmlWriter.TestCase.class,
             ArrayListMap.TestCase.class,
             AssayResultsFileWriter.TestCase.class,
+            AuthenticationManager.ReauthTokenTest.class,
             BaseServerProperties.TestCase.class,
             BooleanFormat.TestCase.class,
             BuilderObjectFactory.TestCase.class,
@@ -552,6 +563,7 @@ public void registerServlets(ServletContext servletCtx)
             UserManager.TestCase.class,
             ViewCategoryManager.TestCase.class,
             WebdavResolverImpl.TestCase.class,
+            WikiRendererType.TestCase.class,
             WorkbookContainerType.TestCase.class,
             WriteableLookAndFeelProperties.TestCase.class
         );

api/src/org/labkey/api/ApiModule.java

@@ -485,7 +485,9 @@ public void testExceptionNotCommitted() throws IOException
             var responseText = ((MockHttpServletResponse)writer.getResponse()).getContentAsString();
             var json = new JSONObject(responseText);
             assertEquals("throwing up", json.getString("exception"));
-            assertTrue(json.has("stackTrace"));
+            assertFalse(json.getBoolean("success"));
+            assertEquals("java.lang.IllegalStateException", json.get("exceptionClass"));
+            assertFalse(json.has("stackTrace"));
             assertFalse(json.has("schemaName"));
         }
 

api/src/org/labkey/api/action/ApiJsonWriter.java

@@ -453,7 +453,6 @@ public JSONObject toJSON(Throwable e)
         JSONObject json = new JSONObject();
         json.put("exception", e.getMessage() != null ? e.getMessage() : e.getClass().getName());
         json.put("exceptionClass", e.getClass().getName());
-        json.put("stackTrace", e.getStackTrace());
         return json;
     }
 

api/src/org/labkey/api/action/ApiResponseWriter.java

@@ -23,8 +23,6 @@
 
 /**
  * View that renders an error collection.
- * User: adam
- * Date: Sep 26, 2007
  */
 public class SimpleErrorView extends JspView<Boolean>
 {