1. 22 Oct, 2024 2 commits
    • Jérome Perrin's avatar
      ERP5Type: don't publish workflow methods · e57ed447
      Jérome Perrin authored
      Wrapping a method in a workflow method should not change the
      publishable state the method.
      If the original method is not publishable, wrapping it in a workflow
      method should not make it publishable.  If the original method is
      publishable, then the wrapped method should still be publishable.
      
      This was always intended to work like this, as we can see in the code
      comment in `WorkflowMethod.__init__` but was not properly tested and got
      broken at some point.
      
      It's important to restore the behavior, because workflow methods such as
      `validate` should not be published, users must only be able to use the
      user interface transitions freely, workflow methods transitions are
      only available if developer expose them in a script - and perform the
      necessary consistency and security checks in that script.
      e57ed447
    • Jérome Perrin's avatar
      testSecurity: adjust test_workflow_transition_protection · f932c89f
      Jérome Perrin authored
      Only "user action" methods needs a security declaration.
      f932c89f
  2. 16 Oct, 2024 5 commits
    • Jérome Perrin's avatar
      testCRM: use valid email address in the test · 007de00c
      Jérome Perrin authored
      `sender@customer.com <sender@customer.com>` used in the test is not a
      valid email address. We have updated to python3.9.20 which comes with a
      fix for CVE-2023-27043 and no longer allow this kind of broken addresses.
      
      Replace the address with a similar valid address,
      `"sender@customer.com" <sender@customer.com>`, that was probably the
      original intention of this test.
      007de00c
    • Jérome Perrin's avatar
      dms: explicitly cast `path` selected columns to char · ee19f449
      Jérome Perrin authored
      On python3, the type of selected columns depend on the data type from
      mariadb side, VARCHAR will be str, BINARY/BLOB will be bytes, etc
      
      These SQL method select path that is first evaluated from a variable
      that is NULL and in that case, mariadb seems to select LONGBLOB as data
      type:
      
          MariaDB [test]> set @defined_as_null=null; drop table if exists tmp; create table tmp as (select @defined_as_null); show create table tmp;
          +-------+------------------------------------------------------------------------------------------------------------------------------------+
          | Table | Create Table                                                                                                                       |
          +-------+------------------------------------------------------------------------------------------------------------------------------------+
          | tmp   | CREATE TABLE `tmp` (
            `@defined_as_null` longblob DEFAULT NULL
          ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci |
          +-------+------------------------------------------------------------------------------------------------------------------------------------+
      
      By casting to CHAR in SQL, on the python side we always have the str
      that we expect here, because this is used as path attribute of a SQL
      brain.
      ee19f449
    • Jérome Perrin's avatar
      custom_zodb: fix a ResourceWarning · 5349d8c4
      Jérome Perrin authored
      5349d8c4
    • Jérome Perrin's avatar
      ProcessingNodeTestCase: also setRequest in timerserver loop · 6102ed47
      Jérome Perrin authored
      This is similar to 18deb716 (ProcessingNodeTestCase: also setRequest
      in processing_node, 2023-05-02), as said in that commit message,
      timerserver loop calls setRequest, but before entering the loop, we
      wait for the portal to be created with:
      
       447   │           try:
       448   │             self.portal = self.app[self.app.test_portal_name]
       449   │           except (AttributeError, KeyError):
       450   │             continue
      
      While accessing like this, this will load classes and initialize dynamic
      modules, on python2 this was OK, but on python3 this was raising an
      error because `getRequest` returned None:
      
        File "./parts/erp5/product/ERP5Type/dynamic/component_package.py", line 449, in load_module
          return self.__load_module(fullname)
        File "./parts/erp5/product/ERP5Type/dynamic/component_package.py", line 416, in __load_module
          erp5.component.ref_manager.add_module(module)
        File "./parts/erp5/product/ERP5Type/dynamic/dynamic_module.py", line 86, in add_module
          self.add_request(get_request())
        File "./parts/erp5/product/ERP5Type/dynamic/dynamic_module.py", line 64, in add_request
          self.setdefault(last_sync, (WeakSet(), set()))[0].add(request_obj)
        File "./lib/python3.9/_weakrefset.py", line 89, in add
          self.data.add(ref(item, self._remove))
      TypeError: cannot create weak reference to 'NoneType' object
      
      On python2, this was actually raising as well, but this error is hidden
      by a `hasattr`, because on python2 `hasattr` ignores all exceptions and
      on python3 it only ignores only `AttributeError`.
      
        File "./parts/erp5/product/ERP5Type/Core/PropertySheet.py", line 61, in createAccessorHolder
          self.applyOnAccessorHolder(accessor_holder, expression_context, portal)
        File "./parts/erp5/product/ERP5Type/Core/PropertySheet.py", line 175, in applyOnAccessorHolder
          for property_definition in self.contentValues():
        File "./parts/erp5/product/ERP5Type/Core/Folder.py", line 1570, in contentValues
          portal_type_id_list = self._getTypesTool().listContentTypes()
        File "./parts/erp5/product/ERP5Type/Tool/TypesTool.py", line 173, in listContentTypes
          provider_value = _getOb(provider, None)
        File "./eggs/Zope-4.8.7-py2.7.egg/OFS/ObjectManager.py", line 323, in _getOb
          if id[:1] != '_' and hasattr(aq_base(self), id):
        File "./parts/erp5/product/ERP5Type/dynamic/lazy_class.py", line 120, in __getattribute__
          self.__class__.loadClass()
      6102ed47
    • Nicolas Wavrant's avatar
  3. 15 Oct, 2024 21 commits
  4. 14 Oct, 2024 6 commits
  5. 02 Oct, 2024 1 commit
  6. 01 Oct, 2024 1 commit
  7. 30 Sep, 2024 1 commit
  8. 27 Sep, 2024 3 commits