1. 20 Oct, 2023 2 commits
    • Vincent Pelletier's avatar
      mixin.erp5.BaseExtensibleTraversableMixin: Do not call PAS with a fake request · 67988359
      Vincent Pelletier authored
      As already documented in this code, unrestrictedTraverse provides a flat dict
      as "request" argument. PAS plugins cannot work with such fake request, so
      such _extractUserIds call will not succeed in authenticating the user, and instead
      produces (suppressed) exceptions within PAS.
      As a result, neither codepaths can be followed:
      - PAS cannot find any user, hence "if len(user_list) > 0:" is false
      - the "else" codepath starts with "request._auth", which obviously raises when
        request is a dict
      So, reorder the code so that the nature of the request is checked before
      either codepath is entered, skipping the bulk of this code and avoiding calling
      into PAS.
      67988359
    • Vincent Pelletier's avatar
  2. 19 Oct, 2023 2 commits
  3. 18 Oct, 2023 3 commits
  4. 17 Oct, 2023 4 commits
  5. 13 Oct, 2023 2 commits
  6. 11 Oct, 2023 3 commits
  7. 10 Oct, 2023 5 commits
  8. 06 Oct, 2023 1 commit
  9. 04 Oct, 2023 2 commits
  10. 03 Oct, 2023 1 commit
  11. 02 Oct, 2023 4 commits
    • Roque's avatar
      Capture the flag game new features · 3a9d947c
      Roque authored
      See merge request nexedi/erp5!1824
      3a9d947c
    • Roque's avatar
      erp5_officejs_drone_capture_flag: new map randomization strategy · 36b5ce60
      Roque authored
      - grid of blocks
      - set of block templates
      - randomization conditions
      - new terrarin texture
      - refine enemy drone collision
      - more aggressive enemies
      36b5ce60
    • Roque's avatar
      erp5_officejs_drone_capture_flag: app display using dialog steps pattern · 26d6772a
      Roque authored
      - drop import/export json
      - API for operator script
      - map utils class update
      - doc api update
      - all visible map parameters are geo
      - allow to run twice
      - fix default ai drone script distance fn
      - fix flag elements position (altitude)
      - better error handling
      26d6772a
    • Roque's avatar
      erp5_officejs_drone_capture_flag: new script operator feature and more · cbf008fa
      Roque authored
      - add a new operator script editor
      - update finish rules and scoring system
      - refactor map parameters
      - map randomization is done now by new class map utils
      - update init flag info msg
      - import/export script feature
      - update web site CSP
      - ui: activate js syntax in user script editor
      - ui: styles, section titles, etc - doc api update
      - fixes/refactoring
      -- fix default target coordinates bug
      -- control empty/invalid user scripts
      -- raise an error on user script syntax error
      -- fix onUpdate timestamp parameter (to integer milliseconds)
      -- fix drone loiter (based on nexedi/erp5!1817/)
      cbf008fa
  12. 29 Sep, 2023 1 commit
  13. 28 Sep, 2023 2 commits
  14. 27 Sep, 2023 1 commit
  15. 19 Sep, 2023 2 commits
  16. 14 Sep, 2023 2 commits
  17. 12 Sep, 2023 1 commit
    • Jérome Perrin's avatar
      Update officejs support request app for strict CSP · 2dc9f19a
      Jérome Perrin authored
      This is a first step to stop using "unsafe" web sections.
      
      This updates support request app to not require `script-src: unsafe-eval` and `style-src: unsafe-inline` in the CSP.
      Dropping `script-src: unsafe-eval` is made possible by using domsugar instead of handlebars for dynamic content. Dropping `style-src: unsafe-inline` by using CSS files instead of inline `style` attributes in the DOM. One minor regression is that the tooltips from the graph on the front page gadget will cause warning because of `unsafe-inline` and not render the series color.
      
      This application was also modernized a bit, it now uses the HTML viewer gadget to display post contents and supports translation.
      
      See merge request nexedi/erp5!1821
      2dc9f19a
  18. 11 Sep, 2023 2 commits
    • Julien Muchembled's avatar
      ListBox: fix possible unexpected acquisition · 8e3d2599
      Julien Muchembled authored
      The use case is a listbox method being called for a document A
      and returning objects that:
      - aren't children of A
      - but wrapped with `.__of__(A)`
      
      By using `aq_self` instead of `aq_base`, the listbox could still
      acquire from the real parent of the returned object and wrongly access
      an attribute directly (e.g. comment) instead of using an appropriate
      method (if there's no `comment` attribute, getComment returns '').
      
      See merge request nexedi/erp5!1820
      8e3d2599
    • Julien Muchembled's avatar
      ListBox: simplify code · 5803f7b6
      Julien Muchembled authored
      5803f7b6