Pull upstream

CHANGELOG.md

@@ -1,3 +1,170 @@
+## 7.1.10 (2024-11-13)
+
+#### Fix
+
+* Fix JS TypeError when action adds rows in one-to-many widget
+
+  <details>
+
+  Page would crash (error 500) in case an action adds rows in one-to-many widget.
+
+  </details>
+
+
+## 7.1.9 (2024-11-12)
+
+#### Fix
+
+* Fix set action attrs on editor fields
+* Fix onChange not triggered on Rating widget
+* Fix populate changes should reflect into collection grid
+* Fix o2m items data conflict issue
+
+  <details>
+
+  When data is reset through action-record or data is updated through popup
+  then updated data should be merged properly to grid data.
+
+  </details>
+
+* Fix x-bind string case sensitive issue
+
+  <details>
+
+  When x-bind output of string field remains same for same field,
+  it should reflect the output value instead of skipping value update.
+
+  </details>
+
+* Disable sorting when we add a row
+
+  <details>
+
+  After manual sort by column, added row could be at the top instead of the bottom.
+
+  </details>
+
+* Fix handling 0 valued in selection widgets
+* Fix orderBy for new rows after save/refresh on o2m grid
+
+  <details>
+
+  On o2m grid, order is normally preserved after search request.
+  Now, search order is applied in case of form save/refresh.
+
+  </details>
+
+* Fix criteria on grid columns search
+* Fix empty criteria in advanced search query
+
+  <details>
+
+  When field or operator is empty then that criteria should not send in search query.
+
+  </details>
+
+* Fix call onChange on m2m record change
+* Fix selection-in attribute support in mass update
+
+## 7.1.8 (2024-10-17)
+
+#### Security
+
+* Always rely on codes when fetching user from profile
+
+  <details>
+
+  Any extends of `com.axelor.auth.pac4j.AuthPac4jUserService.getUser` should takes 
+  care to rely on fetch users by code only (instead of fetching by code and email).
+
+  In case your application use SSO authentication, a carefully review is needed.
+  As we now rely on users codes to retrieve users, make sure the users codes match 
+  the user profile username or email provided by the identity provider (we rely on 
+  pac4j user profile mapping for this). For example, OpenID Connect providers commonly 
+  use `preferred_username` claim as username,but for others such as Azure OpenID Connect 
+  provider, it will use the `upn` claim as username. As fallback is will use the `email` 
+  claim as email. In case of existing users codes not matching identity providers username 
+  or email, it will not retrieve them and users will not be able to log in. Manually change 
+  will be needed, by updating users codes with their email for example.
+
+  </details>
+
+
+## 7.1.7 (2024-10-07)
+
+#### Change
+
+* Fix customize columns in grid view
+
+  <details>
+
+  When we do customize in grid view then 
+  by default hidden columns should be excluded from the columns display list.
+
+  </details>
+
+#### Fix
+
+* Fix inline o2m widget
+* Fix duplicate widget ids that could cause RangeError
+* Fix web services that can have request URI containing non-ASCII characters
+* Fix negative zero conversion
+
+  <details>
+
+  Decimal values between 0 and -1 do not become absolute.
+  For example, -0.5 is no longer converted to 0.5
+
+  </details>
+
+
+
+## 7.1.6 (2024-09-24)
+
+#### Feature
+
+* Add views help link support
+
+  <details>
+
+  Add view help link support (based on `helpLink` attribute). This feature was present 
+  on former version, but wasn't added during React migration.
+
+  The help link button is now placed on end right side of the toolbar.
+
+  </details>
+
+#### Fix
+
+* Validate URL without escaping it on grid
+* Prevent going into edit mode when clicking on an URL on editable grid
+* Change expand icon in tree-grid widget
+
+  <details>
+
+  - Use `>>` for items which contains children items
+  - Use `>` for items which doesn't have any children
+
+  </details>
+
+* Fix updating custom fields having roles
+* Fix action-attrs column attributes for tree-grid widget
+* Fix show errors for custom fields
+* Fix translation and extraction of x-tree-field-title attribute
+* Fix o2m items version conflict when duplicating record
+
+#### Security
+
+* Ask to retype current password on change password page
+
+  <details>
+
+  Instead of passing current password in state after login, ask to 
+  retype current password on change password page.
+
+  </details>
+
+
 ## 7.1.5 (2024-08-08)
 
 #### Change

axelor-core/src/main/java/com/axelor/auth/pac4j/AuthPac4jModule.java

@@ -32,8 +32,11 @@
 import com.google.inject.binder.AnnotatedBindingBuilder;
 import com.google.inject.multibindings.Multibinder;
 import java.util.Collection;
+import java.util.Collections;
+import java.util.List;
 import java.util.Optional;
 import java.util.Set;
+import javax.servlet.Filter;
 import javax.servlet.ServletContext;
 import org.apache.shiro.authc.AuthenticationListener;
 import org.apache.shiro.authc.pam.ModularRealmAuthenticator;
@@ -153,4 +156,15 @@ public DefaultCallbackClientFinder callbackClientFinder(ClientListService client
     }
     return new AxelorCallbackClientFinder();
   }
+
+  /**
+   * Disable global filters due to impact on some web services (ex: <code>ws/files/data-export
+   * </code>). See issue #1193.
+   *
+   * @return empty list
+   */
+  @Override
+  public List<FilterConfig<? extends Filter>> globalFilters() {
+    return Collections.emptyList();
+  }
 }

axelor-core/src/main/java/com/axelor/auth/pac4j/AuthPac4jUserService.java

@@ -63,10 +63,10 @@ public class AuthPac4jUserService {
 
   @Nullable
   public User getUser(CommonProfile profile) {
-    final String codeOrEmail = profileService.getUserIdentifier(profile);
+    final String userIdentifier = profileService.getUserIdentifier(profile);
 
-    if (codeOrEmail != null) {
-      return userRepo.findByCodeOrEmail(codeOrEmail);
+    if (userIdentifier != null) {
+      return userRepo.findByCode(userIdentifier);
     }
 
     return null;

axelor-front/package.json

@@ -16,7 +16,7 @@
     "svgo": "svgo --multipass src/assets/*.svg"
   },
   "dependencies": {
-    "@axelor/ui": "^0.1.9",
+    "@axelor/ui": "^0.1.10",
     "@babel/standalone": "^7.24.3",
     "@fullcalendar/core": "^6.1.11",
     "@fullcalendar/daygrid": "^6.1.11",

axelor-front/src/components/login-form/login-form.tsx

@@ -103,7 +103,7 @@ export function LoginForm({
           navigate(path, {
             state: {
               ...locationState,
-              route: { ...state, username, password },
+              route: { ...state, username },
             },
           });
         } else if (user) {

axelor-front/src/hooks/use-relation/use-editor.tsx

@@ -169,6 +169,7 @@ function Footer({
   const popupCanConfirm = params?.["show-confirm"] !== false;
   const popupCanSave = params?.["popup-save"] !== false;
 
+  const hasToMany = Boolean(onSave); // o2m, m2m grid
   const handlerAtom = usePopupHandlerAtom();
   const handler = useAtomValue(handlerAtom);
 
@@ -197,7 +198,8 @@ function Footer({
 
           const dirtyAtom = handler.dirtyAtom;
           const dirty = (dirtyAtom && get(dirtyAtom)) || state.dirty;
-          const canSave = dirty || !record.id || hasRecordChanged();
+          const canSave =
+            dirty || !record.id || (hasToMany && hasRecordChanged());
 
           try {
             const errors = handler.getErrors?.();
@@ -225,7 +227,7 @@ function Footer({
             console.error(e);
           }
         },
-        [handler, onClose, onSave, onSelect],
+        [handler, hasToMany, onClose, onSave, onSelect],
       ),
     ),
   );