* new branch, added manager as an additional field. Currently having DB issues
* WIP DB Issue with eloquent
* added department to LDAP sync
* removed unused variables
* LDAP and Active Directory has plenty of other [ch15504]
* removed department id from ldap sync
* removed department id from ldap sync
* Update 2021_03_18_184102_adds_several_ldap_fields.php
* Add a way for a user to override the skin setting.
* Add site setting to allow user to change the skin.
* Fix skin list.
Co-authored-by: NMC <info@nmc-lab.com>
* Added better visual cues for login
* Changed box header class to box-header with-border to match other screens
* Since we have all.js now, added class=“minimal” to use icheck
* Let onelogin/php-saml know to use 'X-Forwarded-*' headers if it is from a trusted proxy
* Gracefully handle the case where openssl_csr_new fails when openssl.cnf is invalid/missing
* Improve ui of saml sp metadata by displaying it's url and a download button
I'm going ahead and merging this, since the upgrade doesn't break Flysystem any worse than the current develop is broken, so far as I can tell.
* Upgraded framework to Laravel 6
### TO DO:
- Fix password restriction rules- the old library isn’t compatible with Laravel 6 :(
- Figure out why in-app API calls are returning “Unauthorized”
* More updates from Input:: to Request:: helper
* Switch to Request:: from Input
* Added passport config
* Fixed goofy password minimum in seeder
* Added laravel/helpers
* Changed ($item) to ($item->id) in forms
I have no idea why this is necessary
* Changed ($item) to ($item->id) in forms
* Updated API middleware to auth:api
* Updated with added laravel auth.php values
* FIxed *&!^$%^&$^%!!!! ajax issue
* Switch to Request::get from Input::get
* Switched to Request facade
* Added password security minimums back in
The package we were using has not been updated to Laravel v6, so I created custom validators instead
* Added language strings for error messages for password rules
* Fixed `($item)` issue in formActions for partials
* Add a setting to show assets assigned to other assets #6489
* Update user's views to show assets assigned to other assets #6489
* Add ukrainian and russian translation for the feature #6489 in settings
* Implement #3088: Add "Generate Label" option to "Actions" dropdown menu in individual Asset Details view.
* Add conditional for including the asset number in the URL of the barcode image.
* Change case of variables to pass Codacy PR review standards.
* Fixes#6204 - added email alerts and web/API access to assets due for audits (#6992)
* Added upcoming audit report
TODO: Fid diff/threshold math
* Added route to list overdue / upcoming assets via API
* Controller/API methods for due/overdue audits
We could probably skip this and just handle it via view in the routes…
* Added query scopes for due and overdue audits
* Added audit due console command to kernel
* Added ability to pass audit specs to main API asset search method
* Added audit presenter
* Added bootstrap-tables presenter formatter to display an audit button
* Added gated sidenav items to left nav
* Added audit due/overdue blades
* Cleanup on audit due/overdue console command
* Added language strings for audit views
* Fixed :threshold placeholder
* Removed unused setting variable
* Fixed next audit date math
* Added scope for both overdue and upcoming
* Derp. Wrong version
* Bumped version
(I will release this version officially tomorrow)
* Leave the activated state for users alone in normal LDAP synchronisation. (#6988)
* Fixed#7003 - crash when warranty months or purchase date is null
* Fixed#6956 - viewKeys policy inconsistent (#7009)
* Fixed#6956 - Added additional gates show showing/hiding license keys
* Modified gate to allow user to see licenses if they can create or edit the license as well
* Added API middleware to API routes to enable throttling
TODO: Figure out how to make this costumizable without touching the code
* Import locations from CSV via command line (#7021)
* Added import locations command
* Small fixes to location importer
* Added country, LDAP OU
* Cleaned up comments, added more clarification to what the script does
* Added ability to update groups via API
Fixes [ch9139]
* Bumped version
* Fixed#6883 - remove escaping of fields on LDAP import
* Fixed#6880 - correctly encrypt encrypted fields via the API
* Fixes#5054: LDAP users deactivated for none-ad (#7032)
When using none-AD ldap, users are automatically deactivated every LDAP
sync. This commit changes the behaviour so that if the active flag isn't set,
the users are enabled.
Fixed#5054, at least for 4.X
* Updated packages
- Updating erusev/parsedown (v1.7.2 => 1.7.3): Downloading (100%)
- Updating squizlabs/php_codesniffer (3.4.1 => 3.4.2): Downloading (100%)
- Updating symfony/polyfill-mbstring (v1.10.0 => v1.11.0): Downloading (100%)
- Updating symfony/var-dumper (v3.4.23 => v3.4.27): Downloading (100%)
- Updating league/flysystem (1.0.50 => 1.0.51): Downloading (100%)
- Updating symfony/translation (v3.4.23 => v3.4.27): Downloading (100%)
- Updating nesbot/carbon (1.36.2 => 1.37.1): Downloading (100%)
- Updating symfony/debug (v3.4.23 => v3.4.27): Downloading (100%)
- Updating symfony/console (v3.4.23 => v3.4.27): Downloading (100%)
- Updating symfony/finder (v3.4.23 => v3.4.27): Downloading (100%)
- Updating symfony/polyfill-ctype (v1.10.0 => v1.11.0): Downloading (100%)
- Updating symfony/polyfill-php70 (v1.10.0 => v1.11.0): Downloading (100%)
- Updating symfony/http-foundation (v3.4.23 => v3.4.27): Downloading (100%)
- Updating symfony/event-dispatcher (v3.4.23 => v3.4.27): Downloading (100%)
- Updating symfony/http-kernel (v3.4.23 => v3.4.27): Downloading (100%)
- Updating symfony/process (v3.4.23 => v3.4.27): Downloading (100%)
- Updating symfony/routing (v3.4.23 => v3.4.27): Downloading (100%)
- Updating symfony/polyfill-util (v1.10.0 => v1.11.0): Downloading (100%)
- Updating symfony/polyfill-php56 (v1.10.0 => v1.11.0): Downloading (100%)
- Updating symfony/psr-http-message-bridge (v1.1.1 => v1.1.2): Downloading (failed)
Downloading (100%)
- Updating rollbar/rollbar (v1.7.5 => v1.8.1): Downloading (100%)
- Updating symfony/yaml (v3.4.23 => v3.4.27): Downloading (100%)
- Updating symfony/browser-kit (v3.4.23 => v3.4.27): Downloading (100%)
* Fixed#7044 - API update deleted custom fields if they are not re-presented
* Fixed XSS vulnerability when creating a new categories, etc via modal on create
Same fix as before, because of the weird select2 post-parsing ajax behavior
* Updated email strings
* Fixed#7046 - added user website url back into UI
* Updated language strings
* Bumped version
* Updated packages
* New backups config for spatie
* Removed debugbar service provider (autodiscovery)
* Use laravel v5.5 withCount manual aliases
* Added spatie language files
* Removed old laravel backups config
This config file was renamed in a newer version of spatie laravel-backup
* Set the serialization
* Added the command loader to console kernel
* Renamed fire() to handle()
* Updated withCount to use manual naming
* Updated backup path in backup admin
* Updated travis with new php versions
* Bumped laravel version in readme
* Fixed custom field edit screen
* Fixed baseUrl is undefined error
I literally cannot figure out how this ever worked before.
* Fix for included files in backup
* Bumped version
* Switch has() to filled()
* Change ->has() to ->filled()
* Removed cosole log
* Bumped packages
* Use getReader instead of fetchAssoc for CSV parser
https://csv.thephpleague.com/9.0/upgrading/
* Handle JSON validation errors like 5.4
* Handle JSON validation errors like 5.4
* Handle JSON validation errors like 5.4
* Trying to fix ajax asset validation
This I think gets us closer, but still not handling the validation on the asset properly.
When I do a print_r of the validation in the other items, its looking for an error bag that looks something like this:
```
Illuminate\Support\MessageBag Object
(
[messages:protected] => Array
(
[name] => Array
(
[0] => The name field is required.
)
[seats] => Array
(
[0] => The seats field is required.
)
[category_id] => Array
(
[0] => The category id field is required.
)
)
[format:protected] => :message
)
```
Currently the Assets ajax returns:
```
[2019-05-24 06:52:06] develop.ERROR: array (
'messages' =>
array (
'model_id' =>
array (
0 => 'The model id field is required.',
),
'status_id' =>
array (
0 => 'The status id field is required.',
),
'asset_tag' =>
array (
0 => 'The asset tag field is required.',
),
),
)
```
So not sure why it’s not working.
* Fixed missing asset validation
* Check that a model exists before trying to fiddle with fieldsets
* Tidied up license check
* Removed extra escaping on checkin
* Updated importer to work with newer CSV Reader::getRecords() method
* Fixed field mapping
* Small fix for reordering fields
Fixes Illuminate\Database\QueryException: SQLSTATE[23000]: Integrity constraint violation: 1048 Column 'order' cannot be null (SQL: insert into `custom_field_custom_fieldset` (`custom_field_id`, `custom_fieldset_id`, `order`, `required`) values (12, 7, , 0)) [ch1151]
This needs revisiting for a more solid fix, especially for data that was already entered bad.
* Fixed bug where sorting by company name in Users API did not work
Fixes [ch9200]
* Removed custom fields from AssignedSearch to prevent confusing data in selectlist
Fixes [ch9193]
* Removed alert-danger from tests
* Fixed missed consumables_count withCount() statement
* Fixed Undefined variable user in $backto if checked out to a non-user
Fixes [ch9194]
* Check for valid model before attempting to access fieldsets
Fixes [ch1249]
* Only build the log upload destination path if there is a matching record
Fixes [ch1232]
* Fixed free_seats_count variable name
(I forgot that Laravel switched camel case to snake case for their old 5.4 withCount variables)
* Only gtry to delete the file if a record is found in the log
* Only try to get fieldset if model is valid
* Fixed more camel-casing -> snake-casing
* Only display the file if the log record can be found
* Fixed casing in sync command
* Updated README
* Derp - typo
* Added link to Atlassian plugin
* More Atlassian clarifications
* Show accessory image on view page
* Increased image size to 800px, added lightboxes
* Fixed#7083 - Removed user_exists constraint on department save
If the user has been deleted, this prevented the department from being successfully saved on edit
* Updated branch in version file
* Dockerfile update to bring us up to php v7.1 for Laravel 5.5 (#7084)
* bump up to php7.1
& change deprecated MAINTAINER to a LABEL so it is visible with `docker inspect`
* AND modapache ><
* 2 updates required to get software-properties+ppa
* Bumped version
* Bumped release again :(
* Missed one
* Fixed#7098 - updated backup config for deleteFile() method
* Fixed#7092 - handle weird port forwarding/port numbers for baseUrl
* Bumped version
* Fixed#7099 - set email to null by default for backup notifications
* Removed old comments
* Fixed#7100 - Check if $user isset on checkin
* Increased throttle to 120 requests per minute
* Added Filipino, corrected order for Spanish variations
* Update language strings
* Bumped hash
* Changed has to filled to fix bulk asset editing
* Bumped point version
* Small fixes for phpleague CSB reader v9
* Improved error checking in locations importer
* Fixed#7145 - rename groups table to permissions_group for mysql 8 reserved word compatibility
* Reduce minimum group name length to 2 (from 3)
eg: IT
* Back in time fix FOR #7145 for new installs on MySQL 8+
* Fixed permission insert
//TODO
Handle this via model
* Possible fix for reporting/admin migration back in time
* Fixed#7164 - change table name to permission_groups
* Fixed LDAP password blanking on save
* fixing previous commit's actual wiping of password (#7183)
replaced Input::fille('ldap_pword') with _filled_. Should be good to go.
https://github.com/snipe/snipe-it/issues/7179https://github.com/snipe/snipe-it/issues/7169
* Bumped version
* Downgrading rollbar for Laravel 5.5
* Spelling Correction (#7206)
Fixed Spelling for the word reqrite, to be rewrite.
* Fix#6910: Add logic to manipulate the eloquent query. (#7006)
* Added company_id to consumables_users table
* Added logic to manage when a pivot table doesn't have the column company_id trough a join with users
* Remove a migration that tries to fix this problem, but is not longer necessary
* Addresses #7238 - add PWA code to layout
Needs additional UX testing
* Better log message for bad LDAP connection
* Fixed#7186 - has vs filled in User’s API blanking out groups if no group_ids are passed
* Comment clarification on #7186
* Check for valid seat on hardware view
* Added space between footer and custom message
* Cap warranty months to three characters
Filles rollbar 209
* Cap warranty months to 3 on the frontend blade
* Fixed countable() strings on user destroy
* Check that the user has assets and that the aset model is valid
* Bumped hash
* Caps asset warranty to 20 years
* Command to fix custom field unicode conversion differences between PHP versions (#7263)
* Fixes#7252 form request changes (#7272)
* Fixes for #7252 - custom fields not validating / no validaton messages in API w/form requests
* Removed debug info
* More fixes for #7252
This is mostly working as intended, if not yet the way Laravel wants us to do it.
Right now, the API returns correctly, and the form UI will return highlighted errors, with the input filled in ~sometimes~. I’m not sure why it’s only sometimes yet, but this is potentially progress.
* Removed experimental method
* Check for digits_between:0,240 for warranty
* Removed debug code
* Apply fix from PR #7273 to master
* Bumped hash
* Fixed#7250 - permission issue for API fieldsets and fields endpoints
This applies the change from #7294 to master
* Add @mskrip as a contributor
* Fixed#7270 - Checking-in Assets via API Removes the Item's Asset Name
* CORS for api (#7292)
* Added CORS support to API
* Changed order so CORS will still work if throttle hit
* Added APP_CORS_ALLOWED_ORIGINS env option
* Fixed typo
* Clarified header comments
* More clarification
* DIsable CORS allowed origins by default to replicate existing behavior
* Change variable name to be clearer
* Bumped version
* Added condition to deal with fieldname 'rtd_location' which can be tried to be queried in some places and doesn't exist in database (#7317)
* Added comments to the ByFilter query scope for clarity
* Added accessories checkout/checkin API endpoint
* Fixed CVE-2019-10742
https://nvd.nist.gov/vuln/detail/CVE-2019-10742
* Update README.md (#7334)
Add reference to CSV importer.
* Group related variables in .env
* History importer fixes
* Fixes to history importer
* Added upcoming audit report
TODO: Fid diff/threshold math
* Added route to list overdue / upcoming assets via API
* Controller/API methods for due/overdue audits
We could probably skip this and just handle it via view in the routes…
* Added query scopes for due and overdue audits
* Added audit due console command to kernel
* Added ability to pass audit specs to main API asset search method
* Added audit presenter
* Added bootstrap-tables presenter formatter to display an audit button
* Added gated sidenav items to left nav
* Added audit due/overdue blades
* Cleanup on audit due/overdue console command
* Added language strings for audit views
* Fixed :threshold placeholder
* Removed unused setting variable
* Fixed next audit date math
* Added scope for both overdue and upcoming
* Derp. Wrong version
* Bumped version
(I will release this version officially tomorrow)
* Fixed#6821 - confusing UI for 2FA when 2FA is universally enforced
I also updated the language in the user’s listing table to clarify what “activated” means
* Added login enabled info to user view
* Clarified comments
* Added info about 2FA on user profile
Because why not
* Added nowrap to table, and added 2FA reset for superadmins
* Added validation for errors when the Import Field to map isn't setted
* A slightly correction to the error message
* Added the translation strings for the Error Message
* Change upload js to work with multiple upload elements on a single page
* Change uploadFile in upload modal and form partial
* Change uploadFile to js-uploadFile to avoid potential issues in the future
* Remove duplicate style attribute causing webpack to fail
* Missed a css class in rename to js- prefix
* - Move logo uploads to partial for eaiser usage
- Add label logo
- Add css classes to label elements
- Change label prefix text (M: S: ...) to css::before content for easy removal in config
* Add more css classes to labels
* Allow unescaped " (quot) in css ouput
* Add max size param to partial, set defaults for allowedType and size
* Fixed#6703 - fixes password confirmation
* Removed debugging
* Fixed tests
* I guess we use 10 as the settings for password min in tests
* One more try to fix tests - confirmation won’t validate until password validates
Hardcoded strings was replaced with corresponding placeholders.
Log statuses mentioned in #6406 wasn't translated cause it needs more separate complicated development
* Switch to use username instead of email
* Fixed indenting
* Updated password language
* Updated blades to reflect username instead of email
* Changed password/reset controllers to use username instead of email
* Redirect to login page instead of repeating the password reset form
* Added AWS url to example env
* Upgrader - added check for new storage path and attempt to move
* Ignore symlink
* Updated paths for models
* Moved copy methods
* Added AWS_URL support
For some reasin, Flysystem was generating the wrong AWS url (with a region included)
* Switch to Flysystem for image uploads
* Nicer display of image preview
* Updated image preview on edit blades to use Flysystem
* Twiddled some more paths
* Working filesystems config
* Updated Asset Models and Departments to use Flysystem
* Janky workaround for differing S3/local urls/paths
* Try to smartly use S3 as public disk if S3 is configured
* Use public disk Storage options for public files
* Additional transformer edits for Flysystem
* Removed debugging
* Added missing use Storage directive
* Updated seeders to use Flysystem
* Default logo
* Set a default width
We can potentially override this in settings later
* Use Flysystem for logo upload
* Update downloadFile to use Flysystem
* Updated AssetFilesController to use Flysystem
* Updated acceptance signatures to use Flysystem
* Updated signature view to use Flysystem
This isn’t working 100% yet
* Use Flysystem facade for displaying asset image
* Set assets path
Should clean all these up when we’re done here
* Added Rackspace support for Flysystem
* Added Flysystem migrator console command
* Added use Storage directive for categories
* Added user avatars to Flysystem
* Added profile avatar to Flysystem
* Added the option to delete local files with the migrator
* Added a check to prevent people from trying to move from local to local
* Fixed the selectlists for Flysystem
* Fixed the getImageUrl method to reflect Flysystem
* Fixed AWS copy process
* Fixed models path
* More selectlist updates for Flysystem
* Updated example .envs with updated env variable names
* *sigh*
* Updated non-asset getImageUrl() methods to use Flysystem
* Removed S3 hardcoding
* Use Flysystem in email headers
* Fixed typo
* Removed camera support from asset file upload
We’ll find a way to add this in later (and add that support to all of the other image uploads as well)
* Fixed path for categories
* WIP - Switched to standard handleImages for asset upload.
This is currently broken as I refact the handleImages method. Because the assets store/create methods use their own Form Request, the handleImages method doesn’t exist in that Form Request so it wil error now.
* Fixed css URL error
* Updated Debugbar to latest version (#6265)
v3.2 adds support for Laravel 5.7
* Fixed: Missing CSS file in basic.blade.php (#6264)
* Fixed missing CSS file in basic.blade.php
* Added
* Changed stylesheet import for authorize.blade.php
* Updated composer lock
* Added AWS_BUCKET_ROOT as env variable
* Use nicer image preview for logo upload
* Removed AssetRequest form request
* Removed asset form request, moved custom field validation into model
* Added additional help text for logo upload
* Increased the size of the image resize - should make this a setting tho
* Few more formatting tweaks to logo section of branding blade preview
* Use Flysystem for asset/license file uploads
* Use Flysystem for removing images from models that have been deleted
* Enable backups to use Flysystem
This only handles part of the problem. This just makes it so we can ship files to S3 if we want, but does not account for how we backup files that are hosted on S3
* Use Flysystem to download license files
* Updated audits to use Flysystem
* Extract a handlesimages trait to centralize logic for parsing/storing images on upload in create/edit methods.
* Use same image upload/layout in accessories as consum+components.
* Monster: Cleanup/Refactor http controllers.
This cleans up docblocks, pulls most non-crudy actions into their own
controllers, and does general cleanup/logic refactoring. There /should/
be no functional changes, but we all know how should works..
Extract checkin/checkout functions to a separate controller for accessories.
Move controllers to subdirectory.
Cleanup AssetModelsController
Extract component checkin/checkout
Assorted cleanups/doc/formatting in controllers.
Refactor LicenseController.
Refactor UsersController
Update viewassetscontroller.
* Codacy cleanups
* More codacy cleanups. Extract a LicenseCheckout Form request as well.
* A bit more refactor/cleaning of the license checkout method.
* Review Related Cleanups
* Fix most of the item_not_found translations. In many cases, the
string being generated did not even use the id parameter. Where it
does, pass it as id instead of as a different value.
* Remove some old $data arrays from when we manually sent emails from
the controllers. This has been superseeded by the notification system
(yay!)
* Bugfix: Only log the checkin of an accessory if the checkin completes sucessfully.
* Fixes CustomFieldsetsController::fields() which I think is not used anywhere else and don't think ever worked as you can't call get() on a Collection.
Have tested extensively and doesn't seem to affect anywhere else?
* Adds default value functionality
* Adds built assets
* Fixes assignment to asset_model_id which should have been evaluation and alters route so it sits more in line with existing work
* Updates built assets
* Remove silly docker.env file; fix Dockerfile to preserve Oauth keys (#5377)
* Added department to custom asset export
Updates build assets
* Adds translation support for 'add default values' checkbox label
* Added “show fields in email” to custom fields
* Added “show images in email” to settings
* Added nicer HTML emails
* Break notifications out into their own, instead of trying to mash them all together
* Remove old notification for accessory checkout
* Janky fix for #5076 - “The asset you have attempted to accept was not checked out to you”
* Add method for image url for accessories
* Added accessory checkout email blade
* Make accessory email notification on checkout screen consistent with assets
* Added native consumables notifications
* Fixes for asset notification
* Updated notification blades with correct-er fields
* Updated notifications
* License checkin notification - does not work yet
Need to figure out whether the license seat is assigned to a person or an asset before we can pass the target
* Added alternate “cc” email for admins
* Only try to trigger notifications if the target is a user
* Fix tests
* Fixed consumable URL
* Removed unused notification
* Pass target type in params
* Show slack status
* Pass additional parameters
There is a logic bug in this :( Will send to slack twice, since the admin CC and the user are both using the same notification. Fuckity fuck fuck fuck.
* Pass a variable to the notification to supress the duplicate slack message
* Slack is broken :( Trying to fix
Will try a git bisect
* Put preview back into checkout
* Pulled old archaic mail
* Removed debugging
* Fixed wrong email title
* Fixed slack endpoint not firing
* Poobot, we hardly knew ye.
* Removed old, manual mail from API
* Typo :-/
* Code cleanup
* Use defined formatted date in JSON
* Use static properties for checkin/checkout notifiers for cleaner code
* Removed debugging
* Use date formatter
* Fixed target_type
* Fixed language in consumable email
* More helpful text on how the custom validator works
* Clarified language of custom format, fixed regex example
* Fixed regex example in placeholder
* Added comments to custom fields
* Added regex validation string
* Added valid_regex validator in format requirements
* Removed useles comments
* Fixes#4236 - validate the regex custom validation
* Locations API support for image
* Added manufacturers API support for image
* Added manufacturers API support for image
* Added image support for locations add/update
* Added manufacturer image upload support to controller
* General image string
* Added blade support for image uploads/delete image
* Added $request support (from Input::)
* Added image support in API transformers
* Added image to Manufacturers presenter for data table
* Migration to create image fields
* Ignore the contents of the new image directories
* Create new image upload directories
* Created components/consumables uploads directory
* Fixed missing textSearch scope from companies
* Added ignore for companies uploads directory
* Added blade support for image upload
* Fixed path to upload directory on edit
* Added company image upport to transformers, controllers
* Added image support for categories
* Added support for images in Departments
* Added support for image in Consumables
* Added image support for components
* Fix some n+1 problems
* Use route in notification dropdown to make sure we link to correct page
* Work on better UI support for checkout to non-user. Fix links on index bootstrap table, work towards eliminating assignedUser
* Remove Asset::assigneduser() relationship. Instead add a checkedOutToUser() method and/or port to using assignedTo()
* Adjust string to fit new reality
* Fix#3780. Move the consumables getDataView method to the ApiController. Not entirely RESTful, but it's a weird method that probably doesn't need its own controller and the functionality would be strange to stack on the userscontroller...
* Fix file uploads to assets and restore the delete route.
* Add asset maintence edit action to index.
* Suppliers asset list should link to the related asset, not to the supplier with same ID.
* Asset models page should use polymorphic formatter on assigned to to better handle assorted item types.
* Comment out more assigneduser fallacy until we figure out the query builder approach to searching for location text.
* Adds basic GET api support for CustomFieldsets
Currently there is not support for getting what fields a given fieldset contains
from the API. This commit creates a new API Controller for CustomFieldsets as
well as Transformers for CustomFields CustomFieldsets. Additionally, the api
route has been updated so that a show method can be access from
http://myapp/api/v1/fieldsets/{id}
* CustomFieldsetsTransformer only returns id and name of model
* Added index api method for CustomFieldsets
* Removes copy/paste error in CustomFieldsetController (including search)
* Added id to CustomFieldsetsTransformers
* Adds custom_fieldset_id as a field when storing and updating AssetModels
* Removed uncessesary parameter from CustomFieldsetsController.index
* Cleaned up CustomFieldset API
This is round one of the rethink of checkout-to-everything. A location
now has a manager field, and the manager (by default) be responsible for
assets checked out to the location.
