backport: Add layer of security and download p7zip-full lib on docker #643

AyakorK · 2024-12-02T10:05:06Z

🎩 Description

This PR adds the library p7zip-full to the dockerfile to fix the issue of the data that were not exporting on user profile.
This also adds a layer of security to the code to ensure to generate the file if it doesn't exist or on the opposite if it already does to avoid errors.

📌 Related Issues

Link your PR to an issue

TO SETUP YOUR APP

Please use DOCKER you may absolutely need it to ensure an prod environment lookalike
If you already had setup a docker instance of decidim-tou in the past please run make teardown
If you want to be sure you can run make build
Run the command make run to setup your app
Once it's setup please make sure you access to your platform using the url https://localhost:3000 (beware of cache issues)

TEST THE FEATURE

Log in as a user (or admin)
Access to your profile using "My Account" button
Access "Download your data"
Hit the button
Access https://localhost:3000/letter_opener
Make sure you received the mail with your data

IF YOU RECEIVED IT

Please open your folder using the password in the mail
Make sure everything works correctly and that you received all your data

IF YOU DIDN'T RECEIVE IT

Please access https://localhost:3000/sidekiq
Log as [email protected]
Access to your retries and provide us the error

Tasks

Modify Dockerfile and Dockerfile.local to add p7zip-full
Modify the service to add a layer of security

* feat: add custom sort for processesdepending on new variable * feat: update locales files * feat: update seeds * test: add controller tests for assemblies and processes * chore: update i18n config for unused keys * docs: update overrides * refactor: update env variable after review

* fix: XSS vulnerability with img on initiative form and model * test: add tests for new validation * docs: update overrides section * fix: interference from added extends with migration * style: update with rubocop * fix: ActiveRecord::NoDatabaseError * fix: trying to fix again interference * fix: update initiative fomr extends and modify admin initiative controller * refactor: update with rubocop * fix: validation in initiative_form extends and update test * docs: update overrides section in overloads.md * fix: Update OVERLOADS.md --------- Co-authored-by: Quentin Champenois <[email protected]>

* feat: Bump decidim-awesome to last commit * fix: Fix migration that has been changed since first implementation

* fix error message displaying when reaching proposition add limit * add test * add keys in ignore_missing keys

* feat: Add decidim-cleaner * refactor: Comment env var by default --------- Co-authored-by: Quentin Champenois <[email protected]>

* Install GuestMeetingRegistration module * Update registration module

Co-authored-by: Lucie Grau <[email protected]>

* backport: self hosted cdn * backport: update js files content

* fix: update condition to not empty input value if image is present * test: add system test to check for input value * test: update check for image * test: update img check again * test: last update check img * test: update * test: another update * test: if img is present * test: update other test to avoid ambiguous selector error * test: update to see if image is presnet after save * fix: override editor js in decidim_awesome * test: update system test

* chore: update after pull * fix: order questions by position in serializer * test: add test for question order * refactor: update test * style: remove empty line

* Bump: Guest meeting registration module * refactor(Gemfile): Remove ref reference in Gemfile --------- Co-authored-by: Quentin Champenois <[email protected]>

* feat: add new column to proposal extra fields * feat: add callback to proposal extra field model * test: add test for proposal extra field model * feat: add rake task to update existing data * test: add test for new rake task * feat: add proposal extra field model extends to config * chore: update rubocop rules * refactor: update task and test * create the job file * update rake task * lint code * add tests file * fix rspec * clean double specs * update spec * update spec * update syntax test with a context instade of only 'it' * lint code by removing useless line in job spec file * update spec * add more context in spec file * lint code * update rake tasks test --------- Co-authored-by: barbara oliveira <[email protected]> Co-authored-by: Lucie Grau <[email protected]> Co-authored-by: Quentin Champenois <[email protected]>

* feat(Docker): Add minio service * feat(rake): Add new tasks to cleanup s3 bucket * fix: Add S3 purge rake task * fix: S3 Bucket endpoint for docker local * fix(rake): Active storage clear orphans job * fix(sidekiq): Add sidekiq configuration * fix: Logger for active_storage.rake job * fix: Prevent duplicated ActiveRecord Query

* fix: update to handle processes without start_date or end_date * fix: update sort in controllers * test: update test with process without end date * refactor: optimize queries in controllers and update tests * refactor: update sort processes in controllers --------- Co-authored-by: Lucie Grau <[email protected]>

Release 2.5.0: Merge develop

* add notification with eventmanager * base to watch the CI and see files on github * fix translation key & notififaction displaying * add send_pubication_notification to right file * start test rspec * continuing rspec * potential final test file * fix: Merge proposal command and anonymous proposals * fix: Change ProposalPublishedEvent to SimpleEvent * fix: Proposal Published Event * fix: Push FR locales * test: Add specs for proposal_published_event * update methode & file name * adjust trad key * adjust test file & update name of test file * lint * lint fr trad key * lint * update trad key order * lint * correct trad key link in method * correst rspec * fix rspec * fix: Notification small title * lint(rubocop): Fix offenses * ci: Exclude BeEq Rubocop rule * clean * fix CI * delete test file * add ignore trad key in i118n-tasks.yml to fix CI * update text syntaxe via trad key * add '' in fr trad key --------- Co-authored-by: Quentin Champenois <[email protected]>

#634) This reverts commit 28003b5.

* feat: Addition of the emitter module * fix: Fix failing specs

* add env variable * add UUID and IP to logs * add weighted voting configuration * add secrets for weighted voting * update test to fix CI * continue fix test file * fix CI * fix CI * clean spec * clean and add test

* backport: Backport the Drag & Drop on Scopes on BackOffice * fix: Fix locales that were not normalized or misplaced * test: Add some specs about the check_boxes_tree_helper sort * test: Add specs releated to the backport scopes management * fix: Fix wrong locales * fix: Add the weight sorting on select input of scopes * fix: Add missing locale

* fix: Override Create attachment admin command * fix: Force email notification on attachment event * fix: Override attachment form * feat: Allow admins to toggle notification sending * refactor: Remove override and add extend * lint: Fix rubocop offenses --------- Co-authored-by: Lucie Grau <[email protected]>

…ading when refreshing (#638)

Co-authored-by: Lucie Grau <[email protected]>

* fix: Add block reported user task (#614) * backport: remove sentry (#622) * bump: Module Spam Detection to 4.1.2 (#630) * bump: Fix geocofing on homepage interactive map (#635) * feat: Add module emitter (#633) * feat: Addition of the emitter module * fix: Fix failing specs * Fix/backport decidim awesome slowness on proposals index page (#631) * add env variable * add UUID and IP to logs * add weighted voting configuration * add secrets for weighted voting * update test to fix CI * continue fix test file * fix CI * fix CI * clean spec * clean and add test * backport: Addition of sortable scopes using drag and drop (#632) * backport: Backport the Drag & Drop on Scopes on BackOffice * fix: Fix locales that were not normalized or misplaced * test: Add some specs about the check_boxes_tree_helper sort * test: Add specs releated to the backport scopes management * fix: Fix wrong locales * fix: Add the weight sorting on select input of scopes * fix: Add missing locale * feat: Allow to choose notification settings when attachment added (#627) * fix: Override Create attachment admin command * fix: Force email notification on attachment event * fix: Override attachment form * feat: Allow admins to toggle notification sending * refactor: Remove override and add extend * lint: Fix rubocop offenses --------- Co-authored-by: Lucie Grau <[email protected]> * fix: Remove caching from the geocoding elements to avoid map not reloading when refreshing (#638) * backport: Reorder scopes in meetings (#639) * fix: Scopes can't be updated in BO (#640) Co-authored-by: Lucie Grau <[email protected]> * backport: Add layer of security and download p7zip-full lib on docker (#643) * bump: Bump custom proposal states (#599) * Feat: custom sort for processes (#596) * feat: add custom sort for processesdepending on new variable * feat: update locales files * feat: update seeds * test: add controller tests for assemblies and processes * chore: update i18n config for unused keys * docs: update overrides * refactor: update env variable after review * Fix form initiatives (#600) * fix: XSS vulnerability with img on initiative form and model * test: add tests for new validation * docs: update overrides section * fix: interference from added extends with migration * style: update with rubocop * fix: ActiveRecord::NoDatabaseError * fix: trying to fix again interference * fix: update initiative fomr extends and modify admin initiative controller * refactor: update with rubocop * fix: validation in initiative_form extends and update test * docs: update overrides section in overloads.md * fix: Update OVERLOADS.md --------- Co-authored-by: Quentin Champenois <[email protected]> * bump: Decidim-Awesome to last commit (#607) * feat: Bump decidim-awesome to last commit * fix: Fix migration that has been changed since first implementation * fix: Add Referrer-Policy to strict (#613) * fix: Flash message on proposal limit per user reached (#609) * fix error message displaying when reaching proposition add limit * add test * add keys in ignore_missing keys * fix: Add block reported user task (#614) * feat: Add module decidim-cleaner (#597) * feat: Add decidim-cleaner * refactor: Comment env var by default --------- Co-authored-by: Quentin Champenois <[email protected]> * Install GuestMeetingRegistration module (#615) * Install GuestMeetingRegistration module * Update registration module * feat: Add Sendethics possibility to the sms gateway (#605) Co-authored-by: Lucie Grau <[email protected]> * Bump: Phone authorization handler module (#623) * backport: remove sentry (#622) * backport: Use cdn (#624) * backport: self hosted cdn * backport: update js files content * fix: Missing image in survey question (#621) * fix: update condition to not empty input value if image is present * test: add system test to check for input value * test: update check for image * test: update img check again * test: last update check img * test: update * test: another update * test: if img is present * test: update other test to avoid ambiguous selector error * test: update to see if image is presnet after save * fix: override editor js in decidim_awesome * test: update system test * fix: Questions order in survey export (#618) * chore: update after pull * fix: order questions by position in serializer * test: add test for question order * refactor: update test * style: remove empty line * bump: Guest meeting registration module (#625) * Bump: Guest meeting registration module * refactor(Gemfile): Remove ref reference in Gemfile --------- Co-authored-by: Quentin Champenois <[email protected]> * feat: add decypted private body to extra fields (#608) * feat: add new column to proposal extra fields * feat: add callback to proposal extra field model * test: add test for proposal extra field model * feat: add rake task to update existing data * test: add test for new rake task * feat: add proposal extra field model extends to config * chore: update rubocop rules * refactor: update task and test * create the job file * update rake task * lint code * add tests file * fix rspec * clean double specs * update spec * update spec * update syntax test with a context instade of only 'it' * lint code by removing useless line in job spec file * update spec * add more context in spec file * lint code * update rake tasks test --------- Co-authored-by: barbara oliveira <[email protected]> Co-authored-by: Lucie Grau <[email protected]> Co-authored-by: Quentin Champenois <[email protected]> * feat: Clear minio s3 bucket (#612) * feat(Docker): Add minio service * feat(rake): Add new tasks to cleanup s3 bucket * fix: Add S3 purge rake task * fix: S3 Bucket endpoint for docker local * fix(rake): Active storage clear orphans job * fix(sidekiq): Add sidekiq configuration * fix: Logger for active_storage.rake job * fix: Prevent duplicated ActiveRecord Query * fix: Prevent error on PP sort with end_date nil (#626) * fix: update to handle processes without start_date or end_date * fix: update sort in controllers * test: update test with process without end date * refactor: optimize queries in controllers and update tests * refactor: update sort processes in controllers --------- Co-authored-by: Lucie Grau <[email protected]> * bump: Module Spam Detection to 4.1.2 (#630) * feat: Author notification on proposal publication (#620) * add notification with eventmanager * base to watch the CI and see files on github * fix translation key & notififaction displaying * add send_pubication_notification to right file * start test rspec * continuing rspec * potential final test file * fix: Merge proposal command and anonymous proposals * fix: Change ProposalPublishedEvent to SimpleEvent * fix: Proposal Published Event * fix: Push FR locales * test: Add specs for proposal_published_event * update methode & file name * adjust trad key * adjust test file & update name of test file * lint * lint fr trad key * lint * update trad key order * lint * correct trad key link in method * correst rspec * fix rspec * fix: Notification small title * lint(rubocop): Fix offenses * ci: Exclude BeEq Rubocop rule * clean * fix CI * delete test file * add ignore trad key in i118n-tasks.yml to fix CI * update text syntaxe via trad key * add '' in fr trad key --------- Co-authored-by: Quentin Champenois <[email protected]> * revert: "fix: Flash message on proposal limit per user reached (#609)" (#634) This reverts commit 28003b5. * bump: Fix geocofing on homepage interactive map (#635) * feat: Add module emitter (#633) * feat: Addition of the emitter module * fix: Fix failing specs * Fix/backport decidim awesome slowness on proposals index page (#631) * add env variable * add UUID and IP to logs * add weighted voting configuration * add secrets for weighted voting * update test to fix CI * continue fix test file * fix CI * fix CI * clean spec * clean and add test * backport: Addition of sortable scopes using drag and drop (#632) * backport: Backport the Drag & Drop on Scopes on BackOffice * fix: Fix locales that were not normalized or misplaced * test: Add some specs about the check_boxes_tree_helper sort * test: Add specs releated to the backport scopes management * fix: Fix wrong locales * fix: Add the weight sorting on select input of scopes * fix: Add missing locale * feat: Allow to choose notification settings when attachment added (#627) * fix: Override Create attachment admin command * fix: Force email notification on attachment event * fix: Override attachment form * feat: Allow admins to toggle notification sending * refactor: Remove override and add extend * lint: Fix rubocop offenses --------- Co-authored-by: Lucie Grau <[email protected]> * fix: Remove caching from the geocoding elements to avoid map not reloading when refreshing (#638) * backport: Reorder scopes in meetings (#639) * fix: Scopes can't be updated in BO (#640) Co-authored-by: Lucie Grau <[email protected]> * backport: Add layer of security and download p7zip-full lib on docker --------- Co-authored-by: stephanierousset <[email protected]> Co-authored-by: Quentin Champenois <[email protected]> Co-authored-by: ’Barbara Oliveira <[email protected]> Co-authored-by: Quentin Champenois <[email protected]> Co-authored-by: Alexandru Emil Lupu <[email protected]> Co-authored-by: Lucie Grau <[email protected]> Co-authored-by: barbara oliveira <[email protected]> --------- Co-authored-by: Quentin Champenois <[email protected]> Co-authored-by: stephanierousset <[email protected]> Co-authored-by: Guillaume MORET <[email protected]> Co-authored-by: ’Barbara Oliveira <[email protected]> Co-authored-by: Quentin Champenois <[email protected]> Co-authored-by: Alexandru Emil Lupu <[email protected]> Co-authored-by: barbara oliveira <[email protected]>

AyakorK and others added 30 commits October 3, 2024 10:42

bump: Bump custom proposal states (#599)

0f95315

bump: Decidim-Awesome to last commit (#607)

f4b2228

* feat: Bump decidim-awesome to last commit * fix: Fix migration that has been changed since first implementation

fix: Add Referrer-Policy to strict (#613)

396924a

fix: Flash message on proposal limit per user reached (#609)

28003b5

* fix error message displaying when reaching proposition add limit * add test * add keys in ignore_missing keys

hotfix: Add DE missing locales

65fd0ad

fix: Add block reported user task (#614)

63028f7

feat: Add module decidim-cleaner (#597)

7fce756

* feat: Add decidim-cleaner * refactor: Comment env var by default --------- Co-authored-by: Quentin Champenois <[email protected]>

fix: Bump spam detection to 4.1.1

73b3c6f

Install GuestMeetingRegistration module (#615)

be3a496

* Install GuestMeetingRegistration module * Update registration module

feat: Add Sendethics possibility to the sms gateway (#605)

b331c3b

Co-authored-by: Lucie Grau <[email protected]>

Bump: Phone authorization handler module (#623)

c72f286

backport: remove sentry (#622)

9157876

backport: Use cdn (#624)

27b6e4a

* backport: self hosted cdn * backport: update js files content

fix: Questions order in survey export (#618)

3642867

* chore: update after pull * fix: order questions by position in serializer * test: add test for question order * refactor: update test * style: remove empty line

bump: Guest meeting registration module (#625)

543662b

* Bump: Guest meeting registration module * refactor(Gemfile): Remove ref reference in Gemfile --------- Co-authored-by: Quentin Champenois <[email protected]>

Merge pull request #629 from OpenSourcePolitics/develop

84c7e96

Release 2.5.0: Merge develop

bump: Module Spam Detection to 4.1.2 (#630)

d976ac5

revert: "fix: Flash message on proposal limit per user reached (#609)" (

384b99c

#634) This reverts commit 28003b5.

Merge branch 'rc-2.5.0' into develop

a6ed32c

bump: Fix geocofing on homepage interactive map (#635)

1bcf06d

feat: Add module emitter (#633)

56c0a4f

* feat: Addition of the emitter module * fix: Fix failing specs

Fix/backport decidim awesome slowness on proposals index page (#631)

c66b9c0

* add env variable * add UUID and IP to logs * add weighted voting configuration * add secrets for weighted voting * update test to fix CI * continue fix test file * fix CI * fix CI * clean spec * clean and add test

Quentinchampenois and others added 6 commits November 25, 2024 10:42

fix: Remove caching from the geocoding elements to avoid map not relo…

e2fc405

…ading when refreshing (#638)

backport: Reorder scopes in meetings (#639)

cfe65a9

fix: Scopes can't be updated in BO (#640)

3271771

Co-authored-by: Lucie Grau <[email protected]>

backport: Add layer of security and download p7zip-full lib on docker

2ad38fd

Merge branch 'develop' into backport/7zip_export_not_exporting

24c141c

Quentinchampenois approved these changes Dec 2, 2024

View reviewed changes

AyakorK requested a review from luciegrau December 2, 2024 10:07

AyakorK marked this pull request as ready for review December 2, 2024 10:07

luciegrau approved these changes Dec 2, 2024

View reviewed changes

luciegrau merged commit cded3f9 into develop Dec 2, 2024
14 checks passed

luciegrau mentioned this pull request Dec 2, 2024

Release 2.5.1 #642

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

backport: Add layer of security and download p7zip-full lib on docker #643

backport: Add layer of security and download p7zip-full lib on docker #643

AyakorK commented Dec 2, 2024

backport: Add layer of security and download p7zip-full lib on docker #643

backport: Add layer of security and download p7zip-full lib on docker #643

Conversation

AyakorK commented Dec 2, 2024

🎩 Description

📌 Related Issues

TO SETUP YOUR APP

TEST THE FEATURE

IF YOU RECEIVED IT

IF YOU DIDN'T RECEIVE IT

Tasks