[issue_tracker] Add attachments to issues #5394

maltheism · 2019-10-29T18:52:31Z

Brief summary of changes

Comments are now always visible when viewing an issue.
Issues can now have attachments associated with them.

Attachment is associated with a sha1 hash.

Testing instructions (if applicable)

Checkout PR.
Make an issue.
Add an attachment to the issue.

johnsaigle

I'm sorry to ask for this but I think pretty much all of the PHP will need to be redone. Let me know if you have any questions about the points below.

File uploading is a complicated feature and is hard to get right from a security perspective. From what I can see here there are no protections against path manipulation so this code introduces a vulnerability into the codebase.
New file uploading code should use the class created in my recent PR [Core] Create File Uploader class to standardize and validate file uploads in LORIS . There is an example of usage there. See also https://github.com/aces/Loris/pull/5234/files
This PR is also using non-standard DB operations (I think copied from genomic browser if I'm not mistaken). This isn't advised (genomic browser needs updating).

Additionally:

I don't think there's any purpose in using cryptographically unique identifiers here. Regular MySQL IDs are just fine.
Related: we don't need a new openssl dependency for generating secure random numbers. The code example you've used is four years old. random_int() is fine for such things.
You've committed two ZIP files that should be removed (I'd advise against using git add -A)
All new functions need type hints; new PHP files should declare strict types

I'd recommend refactoring the Issue Tracker to use Request and Response Interfaces in the newer style and from there making use of the new File Uploader class I linked.

maltheism · 2019-10-29T19:58:41Z

Hey @johnsaigle the reason I went with the code I did was because the issue_tracker module does need to be refactored. I thought it would be best to add the features before that task or it would make the task much bigger. I'm not sure how path manipulation would happen with this PR but I didn't see permission checks for the EditIssue.php and just used that as a template for the Attachment.php. I think refactoring after would be best for splitting the task into more easily reviewed PRs.
Also the UUIDs will be discussed at a LORIS meeting because there is a benefit to them that might be worthwhile or I wouldn't have done it.

johnsaigle · 2019-10-29T20:15:41Z

It's a reasonably-sized task but I think it makes sense to implement the Response/Request interfaces first so that you can use the File Upload class. I think this is better than adding more onto something that should be redone anyway.

The security of it goes beyond permission checks. You can look into some merged PRs labelled with "Security" if you want some background.

You've brought up UUIDs before (discussion begins here). I think the points from that thread still stand.

maltheism · 2019-10-29T20:18:30Z

@johnsaigle I spoke with @ridz1208 before writing the code. I even mentioned that PR in the discussion. I think there is a benefit and that I want to discuss at the Loris meeting.

johnsaigle · 2019-10-29T20:22:08Z

For sure we can discuss it further there.

Regardless of the UUID portion, I still think a lot of this will need to be refactored.

In the case that the UUID part continues, you'll need to update and commit the composer.lock file. It would also be good to use a specific version of the SSL dependency.

johnsaigle · 2019-10-30T14:14:38Z

Adding Needs Work due to the following points from my above review:

You've committed two ZIP files that should be removed (I'd advise against using git add -A)

All new functions need type hints; new PHP files should declare strict types

This PR is also using non-standard DB operations (I think copied from genomic browser if I'm not mistaken). This isn't advised (genomic browser needs updating).

These need to be fixed.

Everything else will be decided by further discussion.

christinerogers · 2019-10-30T14:20:12Z

feature change -> requires updates to module spec markdown and also Help text.
marking as Needs Documentation

johnsaigle · 2019-12-17T16:25:33Z

I think there is a benefit and that I want to discuss at the Loris meeting.

This has been discussed in a LORIS meeting as of Dec. 10. The PR is now in @driusan's court to review.

jesscall · 2020-01-15T21:28:06Z

I'm having issues manually testing this.
I believe it has something to do with this line and this other line. See #5839, I believe it wasn't removed during the cleanup

all suggestions added

driusan

hopefully one last minor change..

modules/issue_tracker/jsx/IssueForm.js

Added change

maltheism · 2020-02-27T17:11:49Z

Hi @driusan, all requested changes have been added to the PR.

modules/issue_tracker/jsx/attachments/attachmentsList.js

resolved

maltheism · 2020-02-27T17:52:08Z

Hi @driusan, all the baseURL requested change has been added to the PR.

CHANGELOG.md

Co-Authored-By: Dave MacFarlane <driusan@gmail.com>

maltheism · 2020-02-27T18:11:03Z

Thanks @driusan updated

driusan · 2020-02-27T20:22:12Z

This needs Travis to run on it to be merged

maltheism · 2020-02-27T20:24:38Z

@driusan how do I get travis to start again. I'm wondering if it's a GitHub issue.

driusan · 2020-02-27T20:29:47Z

No idea, all I know is that there's not even a yellow checkmark on the last 2 commits. Sometimes that means there was a GitHub hicup that can be fixed by closing and re-opening the PR, sometimes that means there's a conflict or misformed .travis.yml, and there are probably other potential reasons.

maltheism · 2020-02-27T20:31:10Z

@driusan resurrection of travis happened after closing & reopening.

maltheism added the Category: Feature PR or issue that aims to introduce a new feature label Oct 29, 2019

maltheism requested review from johnsaigle, HenriRabalais, LeighMac, ridz1208 and cmadjar October 29, 2019 18:52

maltheism added the State: Discussion required PR or issue that requires the resolution of a discussion with the relevant parties to proceed label Oct 29, 2019

johnsaigle previously requested changes Oct 29, 2019

View reviewed changes

johnsaigle added the State: Needs work PR awaiting additional work by the author to proceed label Oct 30, 2019

christinerogers added the State: Needs documentation PR that needs a more exhaustive documentation to proceed label Oct 30, 2019

johnsaigle changed the title ~~[issue_tracker] features requests from Leigh~~ [issue_tracker] Add attachments to issues; fix bug where comments were not visible on issues Oct 30, 2019

johnsaigle added the State: Needs rebase PR that needs to be rebased to proceed (conflicts, wrong branch...) label Dec 3, 2019

maltheism force-pushed the issue_tracker_major_leigh_features branch from d52c067 to 47805eb Compare December 9, 2019 17:11

maltheism changed the base branch from major to master December 9, 2019 17:11

maltheism removed the State: Needs rebase PR that needs to be rebased to proceed (conflicts, wrong branch...) label Dec 9, 2019

maltheism changed the title ~~[issue_tracker] Add attachments to issues; fix bug where comments were not visible on issues~~ [issue_tracker] Add attachments to issues Dec 9, 2019

cmadjar assigned maltheism Jan 10, 2020

maltheism removed State: Discussion required PR or issue that requires the resolution of a discussion with the relevant parties to proceed State: Needs work PR awaiting additional work by the author to proceed labels Jan 13, 2020

maltheism requested a review from jesscall January 15, 2020 20:18

johnsaigle added the State: Needs work PR awaiting additional work by the author to proceed label Jan 15, 2020

maltheism force-pushed the issue_tracker_major_leigh_features branch from 74216f1 to 43bdf01 Compare January 15, 2020 23:46

Misotheism added 2 commits February 25, 2020 14:54

remove attachment tests

85efc59

phan fix

5527b13

phan fix

36c3a8b

driusan previously requested changes Feb 26, 2020

View reviewed changes

modules/issue_tracker/jsx/IssueForm.js Outdated Show resolved Hide resolved

update permission passed to props for driusan

0954149

maltheism requested a review from driusan February 26, 2020 23:48

maltheism and others added 3 commits February 27, 2020 11:56

Merge branch 'master' into issue_tracker_major_leigh_features

36bc6ad

update sql insert

4a14a82

update sql insert

0d047d5

driusan previously requested changes Feb 27, 2020

View reviewed changes

modules/issue_tracker/jsx/attachments/attachmentsList.js Outdated Show resolved Hide resolved

Misotheism added 2 commits February 27, 2020 12:40

BaseURL now props

708f2cf

update

6df6225

driusan reviewed Feb 27, 2020

View reviewed changes

CHANGELOG.md Show resolved Hide resolved

Update CHANGELOG.md

7b67891

Co-Authored-By: Dave MacFarlane <driusan@gmail.com>

maltheism closed this Feb 27, 2020

maltheism reopened this Feb 27, 2020

driusan merged commit 6a7b0a0 into aces:master Feb 27, 2020

ridz1208 added this to the 23.0.0 milestone Feb 27, 2020

maltheism deleted the issue_tracker_major_leigh_features branch May 24, 2020 02:04

maltheism removed their assignment May 24, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[issue_tracker] Add attachments to issues #5394

[issue_tracker] Add attachments to issues #5394

maltheism commented Oct 29, 2019 •

edited

Loading

johnsaigle left a comment •

edited

Loading

maltheism commented Oct 29, 2019 •

edited

Loading

johnsaigle commented Oct 29, 2019 •

edited

Loading

maltheism commented Oct 29, 2019

johnsaigle commented Oct 29, 2019

johnsaigle commented Oct 30, 2019

christinerogers commented Oct 30, 2019

johnsaigle commented Dec 17, 2019

jesscall commented Jan 15, 2020 •

edited

Loading

driusan left a comment

maltheism commented Feb 27, 2020

maltheism commented Feb 27, 2020

maltheism commented Feb 27, 2020

driusan commented Feb 27, 2020

maltheism commented Feb 27, 2020

driusan commented Feb 27, 2020

maltheism commented Feb 27, 2020

[issue_tracker] Add attachments to issues #5394

[issue_tracker] Add attachments to issues #5394

Conversation

maltheism commented Oct 29, 2019 • edited Loading

Brief summary of changes

Testing instructions (if applicable)

johnsaigle left a comment • edited Loading

Choose a reason for hiding this comment

maltheism commented Oct 29, 2019 • edited Loading

johnsaigle commented Oct 29, 2019 • edited Loading

maltheism commented Oct 29, 2019

johnsaigle commented Oct 29, 2019

johnsaigle commented Oct 30, 2019

christinerogers commented Oct 30, 2019

johnsaigle commented Dec 17, 2019

jesscall commented Jan 15, 2020 • edited Loading

driusan left a comment

Choose a reason for hiding this comment

maltheism commented Feb 27, 2020

maltheism commented Feb 27, 2020

maltheism commented Feb 27, 2020

driusan commented Feb 27, 2020

maltheism commented Feb 27, 2020

driusan commented Feb 27, 2020

maltheism commented Feb 27, 2020

maltheism commented Oct 29, 2019 •

edited

Loading

johnsaigle left a comment •

edited

Loading

maltheism commented Oct 29, 2019 •

edited

Loading

johnsaigle commented Oct 29, 2019 •

edited

Loading

jesscall commented Jan 15, 2020 •

edited

Loading