* Properly escape log_meta values
* Vue syntax fix to allow npm run dev to work again
* Janky fix for Select2 bug
* Compiled production assets
* Escape user’s last name in API
* Removed duplicate alertClass
* Compiled production assets
* Fixed#6821 - confusing UI for 2FA when 2FA is universally enforced
I also updated the language in the user’s listing table to clarify what “activated” means
* Added login enabled info to user view
* Clarified comments
* Added info about 2FA on user profile
Because why not
* Added nowrap to table, and added 2FA reset for superadmins
* Check for empty headers in import
* Added import permission
* Fixed model path in docblock
* Added import gate to default blade
* Check if the user is an admin OR idf they have import permissions
* Walked back that admin permission
Since admins are bound by full company support, it makes less sense to let admins have this permission by default, versus having them specifically designated to the import permission
* Added validation for errors when the Import Field to map isn't setted
* A slightly correction to the error message
* Added the translation strings for the Error Message
* To see checkin/checkout Date in History of Asset
* Added some logic to get today's date if the checkin_at input is blank
* Updating the action_date taking the value from the action_log table
* Hide created_at field and rename 'Action Date' as only 'Date'
* Fix auto-increment not updating
This is due to the addition of caching for settings. If we're not
explicitly saving the Settings model, then the cache isn't getting
updated, causing the asset tag auto-increment to get an old cached
version with the wrong number
* Move Setting cache clear to an observer
* Change upload js to work with multiple upload elements on a single page
* Change uploadFile in upload modal and form partial
* Change uploadFile to js-uploadFile to avoid potential issues in the future
* Remove duplicate style attribute causing webpack to fail
* Missed a css class in rename to js- prefix
* - Move logo uploads to partial for eaiser usage
- Add label logo
- Add css classes to label elements
- Change label prefix text (M: S: ...) to css::before content for easy removal in config
* Add more css classes to labels
* Allow unescaped " (quot) in css ouput
* Add max size param to partial, set defaults for allowedType and size
add accessories and consumables tables
add selectlist api to:
app\Http\Controllers\Api\AccessoriesController.php
app\Http\Controllers\Api\ConsumablesController.php
app\Http\Controllers\Api\LicensesController.php
templates for selectlist
apply kit to user works
* Fixed#6703 - fixes password confirmation
* Removed debugging
* Fixed tests
* I guess we use 10 as the settings for password min in tests
* One more try to fix tests - confirmation won’t validate until password validates
This bug was a result of attempting to check if the groups field had a value, and only THEN trying to sync the groups. This meant that uf you were removing ALL groups, the sync wouldn’t be triggered.
This still needs to be updated in the API.
Need to confirm that re-enabling `\Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull::class,` won’t mangle anything. I know we ran into some issues when testing a long time ago, but not sure those issues apply anymore, and I can’t remember what they were.
* Starting work on asset history importer.
* Starting work on asset history importer.
* Added checkin target.
* Last change... importing history should also probably be an admin only task.
* Added caching for user and asset queries.
* Updated cache keepalive time to DateTimeInterface
* Updated cache keepalive time to DateTimeInterface
* Cannot log in with generated password from [ch37]
* Cannot log in with generated password from [ch37]. Light cleanup
* Added the fetchHumanBoolean() method.
* Cleaning up the ternary
Add refresh licenses, accessories and consumables tables refresh when add a new element resources\assets\js\snipeit_modals.js
Some design fixes resources\views\kits\edit.blade.php
Add default value to form (template) resources\views\modals\kit-model.blade.php
New routes for kit accessories and kit consumables routes\api.php
New routes for kit models, kit accessories and kit consumables routes\web\kits.php
New templates
* misc_ldap_fixes: Map location from OU, not group
* misc_ldap_fixes: Ensure ldap is initialised for import
* misc_ldap_fixes: Import Job Title
* misc_ldap_fixes: Import telephone, fix field select from schema
* misc_ldap_fixes: Cleanup login error-handling, fix boolean tests
* Fix an issue when trying to checkin a license seat.
* Minor changes in the checkin view, so it can returns to the expected place where the checkin is launched.
* - change generatePassword to be more secure (allow duplicate chars)
- move generatePassword from trait to helper
- fix summary output for sync command
* - Don't treat ldap_active_flag as boolean - fixes sync not working at all when ldap field is set
- Sync non activated users (But set activated=0)
* - Read user first before checking against user settings
* Fix failed logins to not throw exceptions
* Update Ldap.php
* Update Ldap.php
* Update Ldap.php
* Update Ldap.php
* Update Ldap.php
Updating LDAP.php such that the admin bind will ONLY occur if the user attempting auth cannot bind. If that is the case, it will attempt to bind as admin and search for that user, prior to failing.
The previous commit made it such that remote user login could only
be enabled if two factor authentication was also enabled. Unnest
the configuration so that the setting can be applied without.
* Add iCheck png files to webpack config (inconsistency for css <> png) and blue.png to public folder
* php 7.3 collect() fix (undefined variable)
* Fix travis ci
* Add iCheck png files to webpack config (inconsistency for css <> png) and blue.png to public folder
* php 7.3 collect() fix (undefined variable)
* change LDAP implementation from model to (singleton) service
* Re-apply check for content in ldap_server variable before parsing
* Update LDAP implementation
* Switch iCheck to minimal as referenced in js
* Don't init on load but on first access via init (returns ldap enabled status)
* Re-Enable notifications
* Re-add missing test target php versions
* Only init() once (singleton class, so ldap variable is already set)
* Fixed missing oauth tables during setup.
* Custom fields of type "CUSTOM REGEX" are always saved as "ANY"
Fixes#5896
* Updated per PR
Fixed spelling
* Fixed logic error
Moved conditional code from view to controller
Added getFromatType function for dropdown
* Fixed missing oauth tables during setup.
* WIP New LDAP implementation
* WIP New LDAP implementation
* WIP New LDAP implementation
Merge remote-tracking branch 'origin/WIP_LDAP' into WIP_LDAP
* WIP New LDAP implementation
Added Adldap2 to handle ldap intergration.
* Updated per PR quality review
* Added specific LDAP settings method
* Corrected version number
* Added return documentation
* Added imports
* Changed class to be injected into controller
* Updated with PR suggestions
* Fixed missing oauth tables during setup.
* Merge remote-tracking branch 'snipe-it-upstream/develop' into develop
* Merge remote-tracking branch 'snipe-it-upstream/develop' into develop
Merge remote-tracking branch 'origin/develop' into develop
* Fixed error during setup when settings table is not present
* Switch to use username instead of email
* Fixed indenting
* Updated password language
* Updated blades to reflect username instead of email
* Changed password/reset controllers to use username instead of email
* Redirect to login page instead of repeating the password reset form
* Another 'or' caught in a blade template
* Added the requireAcceptance() method in LicenseSeat.php. Changed the permission in checkout-license mail to view.
* Getting right the permission in the view checkout-license
The class was missing as a result that the composer was unable to update and the site returned a 500 error
```
$ composer update
Loading composer repositories with package information
Installing dependencies (including require-dev) from lock file
Nothing to install or update
Package guzzle/guzzle is abandoned, you should avoid using it. Use guzzlehttp/guzzle instead.
Generating optimized autoload files
> Illuminate\Foundation\ComposerScripts::postAutoloadDump
> @php artisan package:discover
In Asset.php line 30:
Declaration of App\Models\Asset::save($params = Array) should be compatible
with Illuminate\Database\Eloquent\Model::save(array $options = Array)
Script @php artisan package:discover handling the post-autoload-dump event returned with error code 1
```
* Added AWS url to example env
* Upgrader - added check for new storage path and attempt to move
* Ignore symlink
* Updated paths for models
* Moved copy methods
* Added AWS_URL support
For some reasin, Flysystem was generating the wrong AWS url (with a region included)
* Switch to Flysystem for image uploads
* Nicer display of image preview
* Updated image preview on edit blades to use Flysystem
* Twiddled some more paths
* Working filesystems config
* Updated Asset Models and Departments to use Flysystem
* Janky workaround for differing S3/local urls/paths
* Try to smartly use S3 as public disk if S3 is configured
* Use public disk Storage options for public files
* Additional transformer edits for Flysystem
* Removed debugging
* Added missing use Storage directive
* Updated seeders to use Flysystem
* Default logo
* Set a default width
We can potentially override this in settings later
* Use Flysystem for logo upload
* Update downloadFile to use Flysystem
* Updated AssetFilesController to use Flysystem
* Updated acceptance signatures to use Flysystem
* Updated signature view to use Flysystem
This isn’t working 100% yet
* Use Flysystem facade for displaying asset image
* Set assets path
Should clean all these up when we’re done here
* Added Rackspace support for Flysystem
* Added Flysystem migrator console command
* Added use Storage directive for categories
* Added user avatars to Flysystem
* Added profile avatar to Flysystem
* Added the option to delete local files with the migrator
* Added a check to prevent people from trying to move from local to local
* Fixed the selectlists for Flysystem
* Fixed the getImageUrl method to reflect Flysystem
* Fixed AWS copy process
* Fixed models path
* More selectlist updates for Flysystem
* Updated example .envs with updated env variable names
* *sigh*
* Updated non-asset getImageUrl() methods to use Flysystem
* Removed S3 hardcoding
* Use Flysystem in email headers
* Fixed typo
* Removed camera support from asset file upload
We’ll find a way to add this in later (and add that support to all of the other image uploads as well)
* Fixed path for categories
* WIP - Switched to standard handleImages for asset upload.
This is currently broken as I refact the handleImages method. Because the assets store/create methods use their own Form Request, the handleImages method doesn’t exist in that Form Request so it wil error now.
* Fixed css URL error
* Updated Debugbar to latest version (#6265)
v3.2 adds support for Laravel 5.7
* Fixed: Missing CSS file in basic.blade.php (#6264)
* Fixed missing CSS file in basic.blade.php
* Added
* Changed stylesheet import for authorize.blade.php
* Updated composer lock
* Added AWS_BUCKET_ROOT as env variable
* Use nicer image preview for logo upload
* Removed AssetRequest form request
* Removed asset form request, moved custom field validation into model
* Added additional help text for logo upload
* Increased the size of the image resize - should make this a setting tho
* Few more formatting tweaks to logo section of branding blade preview
* Use Flysystem for asset/license file uploads
* Use Flysystem for removing images from models that have been deleted
* Enable backups to use Flysystem
This only handles part of the problem. This just makes it so we can ship files to S3 if we want, but does not account for how we backup files that are hosted on S3
* Use Flysystem to download license files
* Updated audits to use Flysystem
When a user has no permissions set (=NULL) in the database (like after an
LDAP import) but is a member of a group with permissions, those group
permissions would not have be applied, effectively denying every access
regardless of group permissions.
* Search functionality in accessories/{accessory} issue #5471:
From the collection of users displayed just filtered the data with the method where() and concat()
for the user can search for first name or last name. The solution is case sensitive.
* A better fix to issue #5471. Now using the established relationship to querying for the users. Also Case-insensitive.
* Fixed previous commit that has magic number in the find method parameter of AccessoriesController.
This was causing the error: Undefined index: App\Models\CustomField (View: /Users/snipe/Sites/snipe-it/snipe-it/resources/views/hardware/index.blade.php)
and pointed to the Eloquent model library method:
```
protected function initializeTraits()
{
foreach (static::$traitInitializers[static::class] as $method) {
$this->{$method}();
}
}
```
Thanks to https://github.com/laravel/framework/issues/25455 for the clue.
From the collection of users displayed just filtered the data with the method where() and concat()
for the user can search for first name or last name. The solution is case sensitive.
* Added Freebsd as vagrant machine for development
* Ran npm audit fix
Manually added peer depenencies
* Added charset=UTF-8 to content-type
Removed reference to throttle model as is is not longer included.
* Add half-year convention in depreciation for Models/Depreciable.php
* Add a setting for the depreciation method
* Integrate half-year convention inside working output
* fix: add more checks at Depreciable.php
* depreciation value rounding
* Codestyle fix
This would only come into play if an inactive user already received a password reset email and then the system was upgraded to prevent those emails from being sent to inactive users
A checkout acceptance gets generated for every item that needs to be checked out. This resource tracks the user user who can accept the item and their signature
I think this merged in a weird order and was missed by the global
find/replace. This fixes bulkassets/bulkusers editing.
At some point we should look at refactoring BulkAssetsController@edit to
only run one DB query, rather than one per item.
* Move findLicenseSeatToCheckout back to controller.
After discussion, move findLicenseSeatToCheckout method back to
controller from form request. Also cleanup one tiny bit more with null
coalesce operator (Yay php 7).
* Revert Earlier change.
$target only exists in the checkoutTo* methods. Need to log the
checkout individually in each of those.
* Extract a handlesimages trait to centralize logic for parsing/storing images on upload in create/edit methods.
* Use same image upload/layout in accessories as consum+components.
* Monster: Cleanup/Refactor http controllers.
This cleans up docblocks, pulls most non-crudy actions into their own
controllers, and does general cleanup/logic refactoring. There /should/
be no functional changes, but we all know how should works..
Extract checkin/checkout functions to a separate controller for accessories.
Move controllers to subdirectory.
Cleanup AssetModelsController
Extract component checkin/checkout
Assorted cleanups/doc/formatting in controllers.
Refactor LicenseController.
Refactor UsersController
Update viewassetscontroller.
* Codacy cleanups
* More codacy cleanups. Extract a LicenseCheckout Form request as well.
* A bit more refactor/cleaning of the license checkout method.
* Review Related Cleanups
* Fix most of the item_not_found translations. In many cases, the
string being generated did not even use the id parameter. Where it
does, pass it as id instead of as a different value.
* Remove some old $data arrays from when we manually sent emails from
the controllers. This has been superseeded by the notification system
(yay!)
* Bugfix: Only log the checkin of an accessory if the checkin completes sucessfully.
* Adds a method to consumables to check if a notification should be sent
Adds the checkin_email method to Consumables, this gets checked in notifications when checking out the consumable.
Without the method, no notifications get sent for checking out consumables.
* Fixes the checkin_email method on the License model
This should allow the License to also send checkout/checkin notifications again.
* Fix Importer emailformat
Str::slug() strips periods from the string, which caused our existing
logic to misbehave when generating a user's email on an import. Adjust
logic to use generateEmail() helper on user instead. Also clean up some
of the logic in this method.
* Remove dead code.
* More refactor/cleanup of the user create method. I think it is almost readable now.
* Give advancedTextSearch all search terms at one
The additional conditions for assets had some problems, since they were joining tables for the additional attributes. The method was called once for every search term, so the join was added multiple times if the user entered multiple search terms.
* Allows search to handle multiple search terms better
The search now better handles multiple search terms, adding additional orWhere clauses, instead of duplicating all queries.
* Fixing typo
* Extract method/cleanup
* Remove apiStore method that is unusued since api controllers.
* Use proper model exception
* Remove old user importer. This is now supported by the general importer framework.
* Refactor AssetsController methods.
This is a giant diff without many functional changes, mostly cosmetic.
I've pulled a number of methods out of assetscontroller, preferring
instead to create some more targetted controllers for related actions.
I think this cleans up the file some, and suggests some places for
future targetted improvement.
Fix weird missing things.
* Fix Unit test failing after date changes.
* Pass valid string to be translated.
* Some method cleanup for codacy.
* Extract trait for common checkout uses and codacy fixes.
* Cleanup model bulk-edit
Use the general partials where appropriate, as well as display a list of
what models we are editing in the bulk edit.
* Use new api based fetch/display for modal select2.
This is just copy/pasting the code currently because I'm not entirely
sure how the two pieces of code interact.
* Remove old helper functions that are no longer necessary with our populating of select2 dropdowns via ajax.
* Adds the ability to search by dates
Adding extra „where“-conditions to the „TextSearch“ queries, allowing the users to search by dates
* Adds missing dates to $dates in models
* Removes duplicated „where“ conditions
* Adds the Searchable trait to models, defining the searchable attributes and relations
* Removes the old text search methods
* Adds back additional conditions to the search
These conditions could not be modeled in the „attributes“ or „relations“, so we include them here
* Removes unnecessary check for the deleted_at attribute
* Fixes typo in comments
* suppresses errors from Codacy
We can safely ignore the error codacy is throwing here, since this method is a standin/noop for models who need to implement more advanced searches
* adds select2 placeholders to select lists
To allow us to clear the selection on „select2“ selects, we need a placeholder attribute
See: https://select2.org/placeholders
* Removes empty option from multiple select
select2 requires an empty option value on singular selects, but not on multiple selects.
When selecting multiple options, this empty option would be shown as selectable otherwise, not clearing the selection.
* Adds the option to clear select2 instances
Sets the correct options to allow clearing of out select2 instances. The empty placeholder is required, since clearing only works when a placeholder ist set (event an empty one).
See: https://select2.org/placeholders
* Removes the „Clear selection“ option from select lists
Since we can clear the select2 lists with their native clearing method, we can remove this hack
* Updates generated assets (css/js)
* Always send checkin notifications to users
This fixes the routing of the notifications, to only send „checkin“ emails if the „mail on checkin“ flag on the category was set. (and we checkout to a user with a non-empty email)
* Fixes checkout notification routing
Notifications to users should be send if the category of the resource (accessory/asset/consumable/license):
a) requires the user to confirm acceptance
b) should send notifications on checkin/checkout
* adds a check for EULAs
Adds back a check for the EULA, since the user should receive the EULA if it was set (regardless of other setings on the category, etc)
* adds permission checks to custom fields
* adds permission checks to custom fieldsets
* adds separate permissions for custom fieldsets
* check for permissions in views
* Removes custom fieldsets from permissions config
* Proxy the authorization for custom fieldsets down to custom fields.
This allows us to use the existing permissions in use and have more semantically correct authorization checks for custom fieldsets.
* simplifies the authorization check for the custom fields overview
* removes special handling of custom fieldsets in base policy
I just realised that this code duplicates the logic from the custom fieldset policy.
Since we are checking for the authorization of custom fields anyway, we can just use the columnName for the fields.
* cleanup of unused imports
* adds permission checks for companies
* adds permission checks for depreciations
* adds permission check for all reports
* fixes permissions for departments
* fixes permission naming (edit -> update)
* fixes authorization checking wrong permission in API
The authorization was checking for the non-existent „edit“ method where it should have checked for the „update“ method.
* adds authorization checks for select2 lists
* adds missing authorization checks for api
* fixes user authorization check for creating users
* adds additional check viewing assets on showing a users assets
* Removes authorization checks for select2 lists
Reference: https://github.com/snipe/snipe-it/pull/5807#pullrequestreview-136018755
* Added option to include model information on asset labels.
Cleaned up label page to fix skewed label alignment on last row per page.
* Changes made per Snipe's direction
changed type from tinyint to boolean in DB
changed labels back to initials
* Added de-norm counter migration for assets
* Renaming counter columns, since Eloquent has a magical *_count helper
* Added artisan command to sync counters (one-off)
* Update API to use de-normed fields
* Increment counters for checkin;/checkout
* Derp.
* Added request increment/decrementer
* Move increment for checkout to the Asset::checkout method
* Added “could take a while” message
* Fixes#4445: prevents assigned assets from being checked out in bulk checkout
* Updates data attribute to more versatile 'data-asset-status-type'
* Fixes broken unit test
* Fixes CustomFieldsetsController::fields() which I think is not used anywhere else and don't think ever worked as you can't call get() on a Collection.
Have tested extensively and doesn't seem to affect anywhere else?
* Adds default value functionality
* Adds built assets
* Fixes assignment to asset_model_id which should have been evaluation and alters route so it sits more in line with existing work
* Updates built assets
* Remove silly docker.env file; fix Dockerfile to preserve Oauth keys (#5377)
* Added department to custom asset export
Updates build assets
* Adds translation support for 'add default values' checkbox label
* Allow setting of "ldap_import" through the API, this will allow cusom scripts to be made to import data from Active directory using the API, this would allow any field to be filled such as the manager (based on the ID), department etc.
* Password fix for LDAP through API
* Fix condition where matching user fails when providing a username but no full name. Also shortcircuit username matching if a user exists.
* Simplify Logic
If the user provided is numeric, but doesn't exist in the database, assume that the user's name is a number and go through all relevant generation. of email/first+last names. Alternatively we may want to abort or remove the is_numeric bits.. it seems a little counterintuitive
* WIP - beginning of improved requested assets
- Use Ajax tables for faster loading
- Use new notifications for requesting an asset
TODO:
- Use ajax tables for requestable asset models
- Use new notifications for canceling an asset request
- Expire requests once the asset has been checked out to the requesting user
* Only show asset name in email if it has one
* Refactor requested method to only include non-canceled requests
* Refactored requestable assets to log request and cancelation
* Added softdeletes on checkout requests
* Differentiate between canceling and deleting requests
* Added asset request cancelation notification
* Added timestamps and corrected unique key on requests table
* Improved requests view
* Re-use blade for cancel/request email
* Refactored BS table formatter for requested assets
* Location name min reduced to 2
* Added PAT test as maintenance option
This needs to be refactored into database-driven options with a UI
* Better slack message
* Added getImageUrl method for assets
* Include qty in request notifications
TODO:
- Try to pull requested info from original request for cancelation, otherwise it will default to 1
* Removed old asset request/cancel emails
* Added user profile asset request routes
* Added profile controller requested assets method
* Added blade link to requested assets for profile view
* Sort user history desc
* Added requested assets blade
* Added canceled at to checkoutRequest method
* Include qty in request
* Fixed comment, removed allowed_columns
* Removed Queable methods, since we don’t use a queue
* Fixed return type in method doc
* Fixed version number
* Changed id to user_id for clarity
Filter down the custom fields we are iterating over to only custom fields in the header row.
This prevents nulling out fields when performing an import-update that doesn't include
all custom fields as well as properly nulls out values between items being imported.
Filter down the custom fields we are iterating over to only custom fields in the header row.
This prevents nulling out fields when performing an import-update that doesn't include
all custom fields as well as properly nulls out values between items being imported.
* Added “show fields in email” to custom fields
* Added “show images in email” to settings
* Added nicer HTML emails
* Break notifications out into their own, instead of trying to mash them all together
* Remove old notification for accessory checkout
* Janky fix for #5076 - “The asset you have attempted to accept was not checked out to you”
* Add method for image url for accessories
* Added accessory checkout email blade
* Make accessory email notification on checkout screen consistent with assets
* Added native consumables notifications
* Fixes for asset notification
* Updated notification blades with correct-er fields
* Updated notifications
* License checkin notification - does not work yet
Need to figure out whether the license seat is assigned to a person or an asset before we can pass the target
* Added alternate “cc” email for admins
* Only try to trigger notifications if the target is a user
* Fix tests
* Fixed consumable URL
* Removed unused notification
* Pass target type in params
* Show slack status
* Pass additional parameters
There is a logic bug in this :( Will send to slack twice, since the admin CC and the user are both using the same notification. Fuckity fuck fuck fuck.
* Pass a variable to the notification to supress the duplicate slack message
* Slack is broken :( Trying to fix
Will try a git bisect
* Put preview back into checkout
* Pulled old archaic mail
* Removed debugging
* Fixed wrong email title
* Fixed slack endpoint not firing
* Poobot, we hardly knew ye.
* Removed old, manual mail from API
* Typo :-/
* Code cleanup
* Use defined formatted date in JSON
* Use static properties for checkin/checkout notifiers for cleaner code
* Removed debugging
* Use date formatter
* Fixed target_type
* Fixed language in consumable email
* Added authentication via Remote User
* - Removed nullable from remote_user settings fileds and used just default values instead
- Removed german translations
- Removed 401 error page and replaced usage with 403 error page as 401 was actual a duplicate of 403
- Replaced usage of $_SERVER['REMOTE_USER'] with Laravels API Request::server('REMOVE_USER')
* - Fixed request usage
This restore() is still not working, though not sure why. Seems like it should be pretty straghtforward, and yet…
Additonally, manually setting the deleted)at date to null or blank isn’t working either. I’m sure I’m just missing something obvious.
* New Test Notification
Created Test Notification.
Updated Vendor Mail message.blade files.
Updated api settings controller to use Notification Façade.
* Add show URL in Emails condition
* New Welcome Notification
