Merge pull request #2513 from xibosignage/feature/giacobini-merge-dev…

…elop Merge develop into giacobini ahead of the 4.1.0-alpha release
xibosignage · Apr 30, 2024 · 4f150c4 · 4f150c4
2 parents f58d97f + ab6b509
commit 4f150c4
Show file tree

Hide file tree

Showing 102 changed files with 596 additions and 917 deletions.
diff --git a/lib/Connector/AlphaVantageConnector.php b/lib/Connector/AlphaVantageConnector.php
@@ -1,6 +1,6 @@
 <?php
 /*
- * Copyright (C) 2023 Xibo Signage Ltd
+ * Copyright (C) 2024 Xibo Signage Ltd
  *
  * Xibo - Digital Signage - https://xibosignage.com
  *
@@ -117,7 +117,11 @@ public function onDataRequest(WidgetDataRequestEvent $event)
                 $event->getDataProvider()->setCacheTtl($this->getSetting('cachePeriod', 3600));
             } catch (\Exception $exception) {
                 $this->getLogger()->error('onDataRequest: Failed to get results. e = ' . $exception->getMessage());
-                $dataProvider->addError(__('Unable to contact the AlphaVantage API'));
+                if ($exception instanceof InvalidArgumentException) {
+                    $dataProvider->addError($exception->getMessage());
+                } else {
+                    $dataProvider->addError(__('Unable to contact the AlphaVantage API'));
+                }
             }
         }
     }
@@ -231,7 +235,7 @@ private function getStockResults(DataProviderInterface $dataProvider): void
 
         if ($items == '') {
             $this->getLogger()->error('Missing Items for Stocks Module with WidgetId ' . $dataProvider->getWidgetId());
-            throw new InvalidArgumentException(__('Missing Items for Stocks Module'), 'items');
+            throw new InvalidArgumentException(__('Add some stock symbols'), 'items');
         }
 
         // Parse items out into an array

diff --git a/lib/Connector/XiboExchangeConnector.php b/lib/Connector/XiboExchangeConnector.php
@@ -219,7 +219,7 @@ private function createSearchResult($template) : SearchResult
         $searchResult->title = $template->title;
         $searchResult->description = empty($template->description)
             ? null
-            : Parsedown::instance()->line($template->description);
+            : Parsedown::instance()->setSafeMode(true)->line($template->description);
 
         // Optional data
         if (property_exists($template, 'tags') && count($template->tags) > 0) {

diff --git a/lib/Controller/DataSetRss.php b/lib/Controller/DataSetRss.php
@@ -1,8 +1,8 @@
 <?php
-/**
- * Copyright (C) 2021 Xibo Signage Ltd
+/*
+ * Copyright (C) 2024 Xibo Signage Ltd
  *
- * Xibo - Digital Signage - http://www.xibo.org.uk
+ * Xibo - Digital Signage - https://xibosignage.com
  *
  * This file is part of Xibo.
  *
@@ -29,15 +29,11 @@
 use PicoFeed\Syndication\Rss20ItemBuilder;
 use Slim\Http\Response as Response;
 use Slim\Http\ServerRequest as Request;
-use Slim\Views\Twig;
 use Stash\Interfaces\PoolInterface;
 use Xibo\Factory\DataSetColumnFactory;
 use Xibo\Factory\DataSetFactory;
 use Xibo\Factory\DataSetRssFactory;
 use Xibo\Helper\DateFormatHelper;
-use Xibo\Helper\SanitizerService;
-use Xibo\Service\ConfigServiceInterface;
-use Xibo\Service\LogServiceInterface;
 use Xibo\Storage\StorageServiceInterface;
 use Xibo\Support\Exception\AccessDeniedException;
 use Xibo\Support\Exception\GeneralException;
@@ -664,6 +660,8 @@ public function delete(Request $request, Response $response, $id, $rssId)
     }
 
     /**
+     * Output feed
+     *  this is a public route (no authentication requried)
      * @param Request $request
      * @param Response $response
      * @param $psk
@@ -683,7 +681,9 @@ public function feed(Request $request, Response $response, $psk)
             $dataSet = $this->dataSetFactory->getById($feed->dataSetId);
 
             // What is the edit date of this data set
-            $dataSetEditDate = ($dataSet->lastDataEdit == 0) ? Carbon::now()->subMonths(2) : Carbon::createFromTimestamp($dataSet->lastDataEdit);
+            $dataSetEditDate = ($dataSet->lastDataEdit == 0)
+                ? Carbon::now()->subMonths(2)
+                : Carbon::createFromTimestamp($dataSet->lastDataEdit);
 
             // Do we have this feed in the cache?
             $cache = $this->pool->getItem('/dataset/rss/' . $feed->id);
@@ -692,7 +692,10 @@ public function feed(Request $request, Response $response, $psk)
 
             if ($cache->isMiss() || $cache->getCreation() < $dataSetEditDate) {
                 // We need to recache
-                $this->getLog()->debug('Generating RSS feed and saving to cache. Created on ' . (($cache->getCreation() !== false) ? $cache->getCreation()->format(DateFormatHelper::getSystemFormat()) : 'never'));
+                $this->getLog()->debug('Generating RSS feed and saving to cache. Created on '
+                    . ($cache->getCreation()
+                        ? $cache->getCreation()->format(DateFormatHelper::getSystemFormat())
+                        : 'never'));
 
                 $output = $this->generateFeed($feed, $dataSetEditDate, $dataSet);
 
@@ -705,10 +708,10 @@ public function feed(Request $request, Response $response, $psk)
 
             $response->withHeader('Content-Type', 'application/rss+xml');
             echo $output;
-
-        } catch (NotFoundException $notFoundException) {
+        } catch (NotFoundException) {
             $this->getState()->httpStatus = 404;
         }
+        return $response;
     }
 
     /**
@@ -718,12 +721,14 @@ public function feed(Request $request, Response $response, $psk)
      * @return string
      * @throws \Xibo\Support\Exception\NotFoundException
      */
-    private function generateFeed($feed, $dataSetEditDate, $dataSet)
+    private function generateFeed($feed, $dataSetEditDate, $dataSet): string
     {
         // Create the start of our feed, its description, etc.
         $builder = Rss20FeedBuilder::create()
             ->withTitle($feed->title)
             ->withAuthor($feed->author)
+            ->withFeedUrl('')
+            ->withSiteUrl('')
             ->withDate($dataSetEditDate);
 
         $sort = $feed->getSort();
@@ -860,6 +865,7 @@ private function generateFeed($feed, $dataSetEditDate, $dataSet)
 
         foreach ($dataSetResults as $row) {
             $item = Rss20ItemBuilder::create($builder);
+            $item->withUrl('');
 
             $hasContent = false;
             $hasDate = false;
@@ -880,7 +886,7 @@ private function generateFeed($feed, $dataSetEditDate, $dataSet)
                     } else if ($mappings[$key]['dataSetColumnId'] === $feed->publishedDateColumnId) {
                         try {
                             $date = Carbon::createFromTimestamp($value);
-                        } catch (InvalidDateException $dateException) {
+                        } catch (InvalidDateException) {
                             $date = $dataSetEditDate;
                         }
 
@@ -892,11 +898,13 @@ private function generateFeed($feed, $dataSetEditDate, $dataSet)
                 }
             }
 
-            if (!$hasDate)
+            if (!$hasDate) {
                 $item->withPublishedDate($dataSetEditDate);
+            }
 
-            if ($hasContent)
+            if ($hasContent) {
                 $builder->withItem($item);
+            }
         }
 
         // Found, do things

diff --git a/lib/Controller/Layout.php b/lib/Controller/Layout.php
@@ -415,11 +415,12 @@ public function add(Request $request, Response $response)
 
             // Empty template so we create a blank layout with the provided resolution
             if (empty($resolutionId)) {
-                // Pick landscape
-                $resolution = $this->resolutionFactory->getByDimensions(1920, 1080);
-                $resolutionId = $resolution->resolutionId;
+                // Get the nearest landscape resolution we can
+                $resolution = $this->resolutionFactory->getClosestMatchingResolution(1920, 1080);
 
-                $this->getLog()->debug('add: no resolution resolved: ' . $resolutionId);
+                // Get the ID
+                $resolutionId = $resolution->resolutionId;
+                $this->getLog()->debug('add: resolution resolved: ' . $resolutionId);
             }
 
             $layout = $this->layoutFactory->createFromResolution(
@@ -1601,7 +1602,7 @@ public function grid(Request $request, Response $response)
                     // Parse down for description
                     $layout->setUnmatchedProperty(
                         'descriptionFormatted',
-                        Parsedown::instance()->text($layout->description)
+                        Parsedown::instance()->setSafeMode(true)->text($layout->description)
                     );
                 } else if ($showDescriptionId == 2) {
                     $layout->setUnmatchedProperty('descriptionFormatted', strtok($layout->description, "\n"));
@@ -3364,7 +3365,7 @@ public function createFullScreenLayout(Request $request, Response $response): Re
                     $media->height
                 )->resolutionId;
             } else if ($type === 'playlist') {
-                $resolutionId = $this->resolutionFactory->getByDimensions(
+                $resolutionId = $this->resolutionFactory->getClosestMatchingResolution(
                     1920,
                     1080
                 )->resolutionId;

diff --git a/lib/Controller/Library.php b/lib/Controller/Library.php
@@ -2507,7 +2507,7 @@ public function uploadFromUrl(Request $request, Response $response)
         }
 
         // if we were provided with optional Media name set it here, otherwise get it from download info
-        $name = empty($optionalName) ? $downloadInfo['filename'] : $optionalName;
+        $name = empty($optionalName) ? htmlspecialchars($downloadInfo['filename']) : $optionalName;
 
         // double check that provided Module Type and Extension are valid
         if (!Str::contains($module->getSetting('validExtensions'), $ext)) {

diff --git a/lib/Controller/Login.php b/lib/Controller/Login.php
@@ -1,8 +1,8 @@
 <?php
 /*
- * Copyright (C) 2023 Xibo Signage Ltd
+ * Copyright (C) 2024 Xibo Signage Ltd
  *
- * Xibo - Digital Signage - http://www.xibo.org.uk
+ * Xibo - Digital Signage - https://xibosignage.com
  *
  * This file is part of Xibo.
  *
@@ -327,16 +327,21 @@ public function forgottenPassword(Request $request, Response $response)
             if (!$mail->send()) {
                 throw new ConfigurationException('Unable to send password reminder to ' . $user->email);
             } else {
-                $this->getFlash()->addMessage('login_message', __('Reminder email has been sent to your email address'));
+                $this->getFlash()->addMessage(
+                    'login_message',
+                    __('A reminder email will been sent to this user if they exist'),
+                );
             }
 
             // Audit Log
             $this->getLog()->audit('User', $user->userId, 'Password Reset Link Granted', [
                 'UserAgent' => $request->getHeader('User-Agent')
             ]);
-        } catch (GeneralException $xiboException) {
-            $this->getLog()->debug($xiboException->getMessage());
-            $this->getFlash()->addMessage('login_message', __('User not found'));
+        } catch (GeneralException) {
+            $this->getFlash()->addMessage(
+                'login_message',
+                __('A reminder email will been sent to this user if they exist'),
+            );
         }
 
         $this->setNoOutput(true);

diff --git a/lib/Controller/Playlist.php b/lib/Controller/Playlist.php
@@ -1,6 +1,6 @@
 <?php
 /*
- * Copyright (C) 2023 Xibo Signage Ltd
+ * Copyright (C) 2024 Xibo Signage Ltd
  *
  * Xibo - Digital Signage - https://xibosignage.com
  *
@@ -1316,8 +1316,9 @@ public function libraryAssign(Request $request, Response $response, $id)
         // Expect a list of mediaIds
         $media = $sanitizedParams->getIntArray('media');
 
-        if (count($media) <= 0)
+        if (empty($media)) {
             throw new InvalidArgumentException(__('Please provide Media to Assign'), 'media');
+        }
 
         // Optional Duration
         $duration = ($sanitizedParams->getInt('duration'));

diff --git a/lib/Controller/Template.php b/lib/Controller/Template.php
@@ -1,6 +1,6 @@
 <?php
 /*
- * Copyright (C) 2023 Xibo Signage Ltd
+ * Copyright (C) 2024 Xibo Signage Ltd
  *
  * Xibo - Digital Signage - https://xibosignage.com
  *
@@ -159,7 +159,7 @@ public function grid(Request $request, Response $response)
             // Parse down for description
             $template->setUnmatchedProperty(
                 'descriptionWithMarkup',
-                Parsedown::instance()->text($template->description)
+                Parsedown::instance()->setSafeMode(true)->text($template->description),
             );
 
             if ($this->getUser()->featureEnabled('template.modify')
@@ -396,7 +396,7 @@ public function search(Request $request, Response $response)
                 // Handle the description
                 $searchResult->description = '';
                 if (!empty($template->description)) {
-                    $searchResult->description = Parsedown::instance()->line($template->description);
+                    $searchResult->description = Parsedown::instance()->setSafeMode(true)->line($template->description);
                 }
                 $searchResult->orientation = $template->orientation;
                 $searchResult->width = $template->width;

diff --git a/lib/Entity/DataSet.php b/lib/Entity/DataSet.php
@@ -1130,7 +1130,7 @@ private function createTable()
           CREATE TABLE `dataset_' . $this->dataSetId . '` (
             `id` int(11) NOT NULL AUTO_INCREMENT,
             PRIMARY KEY (`id`)
-          ) ENGINE=InnoDB DEFAULT CHARSET=utf8 AUTO_INCREMENT=1
+          ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 AUTO_INCREMENT=1
         ', []);
     }
 

diff --git a/lib/Entity/Layout.php b/lib/Entity/Layout.php
@@ -1812,32 +1812,6 @@ public function assessWidgetStatus(Module $module, Widget $widget, int &$status)
                 $template
                     ->decorateProperties($widget)
                     ->validateProperties('status');
-            } else if ($templateId === 'elements' && $module->hasRequiredElements()) {
-                // Make sure our required element is present.
-                $providedElements = [];
-
-                $widgetElements = $widget->getOptionValue('elements', null);
-                if (!empty($widgetElements)) {
-                    // Elements will be JSON
-                    $widgetElements = json_decode($widgetElements, true);
-
-                    // go through the arrays to get properties array inside of elements
-                    // find fontFamily property, add it to fonts array if we do not already have it there
-                    foreach (($widgetElements ?? []) as $widgetElement) {
-                        foreach (($widgetElement['elements'] ?? []) as $element) {
-                            $providedElements[] = $element['id'];
-                        }
-                    }
-                }
-
-                $missingElements = array_diff($module->requiredElements, $providedElements);
-
-                if (count($missingElements) > 0) {
-                    throw new NotFoundException(
-                        __('Missing one or more required elements'),
-                        implode(',', $missingElements),
-                    );
-                }
             }
 
             // If we have validator interfaces, then use it now

diff --git a/lib/Entity/Media.php b/lib/Entity/Media.php
@@ -1,6 +1,6 @@
 <?php
 /*
- * Copyright (C) 2023 Xibo Signage Ltd
+ * Copyright (C) 2024 Xibo Signage Ltd
  *
  * Xibo - Digital Signage - https://xibosignage.com
  *
@@ -575,6 +575,9 @@ private function add()
             $fileName = substr(basename($fileName), 0, strpos(basename($fileName), '?'));
         }
 
+        // Sanitize what we have left.
+        $fileName = htmlspecialchars($fileName);
+
         $this->mediaId = $this->getStore()->insert('
             INSERT INTO `media` (`name`, `type`, duration, originalFilename, userID, retired, moduleSystemFile, released, apiRef, valid, `createdDt`, `modifiedDt`, `enableStat`, `folderId`, `permissionsFolderId`, `orientation`, `width`, `height`)
               VALUES (:name, :type, :duration, :originalFileName, :userId, :retired, :moduleSystemFile, :released, :apiRef, :valid, :createdDt, :modifiedDt, :enableStat, :folderId, :permissionsFolderId, :orientation, :width, :height)

diff --git a/lib/Factory/BaseFactory.php b/lib/Factory/BaseFactory.php
@@ -362,8 +362,15 @@ protected function parseComparisonOperator($variable)
      * @param array $params Array of parameters passed by reference
      * @param bool $useRegex flag to match against a regex pattern
      */
-    public function nameFilter($tableName, $tableColumn, $terms, &$body, &$params, $useRegex = false, $logicalOperator = 'OR')
-    {
+    public function nameFilter(
+        $tableName,
+        $tableColumn,
+        $terms,
+        &$body,
+        &$params,
+        $useRegex = false,
+        $logicalOperator = 'OR'
+    ) {
         $i = 0;
 
         $tableAndColumn = $tableName . '.' . $tableColumn;
@@ -377,7 +384,7 @@ public function nameFilter($tableName, $tableColumn, $terms, &$body, &$params, $
             $searchName = trim($searchName);
 
             // Discard any incompatible
-            if ($searchName === '-' || empty($searchName)) {
+            if (empty(ltrim($searchName, '-')) || empty($searchName)) {
                 continue;
             }