rebase

.gitignore

@@ -11,4 +11,9 @@ composer.phar
 *.PHPEditProject
 /avatars/*
 /lang/*.php.bak
-/lang/*.php.safe
+/lang/*.php.safe
+.vscode/*
+!.vscode/settings.json
+!.vscode/tasks.json
+!.vscode/launch.json
+!.vscode/extensions.json

.travis.yml

@@ -1,23 +1,19 @@
-language: php
+dist: xenial
 
-# Container-based infrastructure
-sudo: false
+language: php
 
 # Cache composer
 cache:
   directories:
     - $HOME/.composer/cache
 
+services:
+  - mysql
+  - postgresql
+
 php:
-# composer needs at least php5.3.2, so php5.2 can't be tested here. Only with a full release with all additional packages yet installed..
-#  - 5.2
-#  - 5.3
-  - 5.4
-
 # no extensive travis testing before we have some real tests and project stable
-#  - 5.5
-  - 5.6
-#  - hhvm
+  - 7.2
 
 # optionally specify a list of environments, for example to test different RDBMS
 env:
@@ -32,7 +28,7 @@ install:
 before_script:
 - if [[ "$DB" == "pgsql" ]]; then psql -c "DROP DATABASE IF EXISTS flyspray_test;" -U postgres; fi
 - if [[ "$DB" == "pgsql" ]]; then psql -c "CREATE DATABASE flyspray_test;" -U postgres; fi
-- if [[ "$DB" == "mysql" ]]; then mysql -e "CREATE DATABASE IF NOT EXISTS flyspray_test;" -uroot; fi
+- if [[ "$DB" == "mysql" ]]; then mysql -e "CREATE DATABASE IF NOT EXISTS flyspray_test DEFAULT CHARSET=utf8mb4;"; fi
 
 # omitting "script:" will default to phpunit
 # use the $DB env variable to determine the phpunit.xml to use

README.md

@@ -1,4 +1,4 @@
-[![Build Status](https://travis-ci.org/Flyspray/flyspray.svg?branch=master)](https://travis-ci.org/Flyspray/flyspray) Flyspray/flyspray
+[![Build Status](https://travis-ci.org/Flyspray/flyspray.svg?branch=master)](https://travis-ci.org/Flyspray/flyspray)
 
 Please do not use Github for your bug reports or feature request. Instead use our live bug tracker at https://bugs.flyspray.org
 
@@ -28,14 +28,14 @@ http://flyspray.org/manual/install
 4. Make sure flyspray.conf.php is writeable by the webserver.
 5. Open http://yourflyspray/setup/ in your webbrowser. It detects the existing installation and you can follow the upgrade steps.
 
-6. Note: Do not forget to press F5 (or CTRL+F5, depending on cache policy) after the upgrade in web browser to reload also cached css-files to see effects of updated CSS-files. They are cached by default for 14 days in the webbrowser.
+6. Note: Do not forget to press F5 (or CTRL+F5, depending on cache policy) after the upgrade in web browser to reload also cached CSS-files to see effects of updated CSS-files. They are cached by default for 14 days in the webbrowser.
 
 ## Dependencies
 
 ### Install php
     Linux: Just use the package manager or one of its frontends of your Linux distribution.
     For instance for Debian based Linux distributions:
-    sudo apt-get install php5
+    sudo apt-get install php
 
     Windows:
     http://php.net/downloads
@@ -44,26 +44,23 @@ http://flyspray.org/manual/install
 
 #### Installing from prepackaged releases that include also needed 3rd party libraries
 
-Choose the matching download for your php version from http://www.flyspray.org/docs/download/
-
-    unzip flyspray-1.0*.zip  (or tar xzf flyspray-1.0*.tgz if you prefer .tgz downloads)
+    tar xzf flyspray-1.0-rc9.tgz
 
-Point your webbrowser where use unzipped the download file and follow the configuration instructions. 
+Rename folder flyspray-1.0-rc9 to shorter name or move to webroot if you want and point your webbrowser there and follow the configuration instructions.
 
 #### Installing from source releases via command line
 
-    unzip flyspray-1.0*.zip  (or tar xzf flyspray-1.0*.tar.gz if you prefer the .tar.gz download)
-    cd flyspray-1.0*
+    curl -L https://github.com/Flyspray/flyspray/archive/v1.0-rc9.tar.gz | tar xz
+    cd flyspray-1.0-rc9
     curl -sS https://getcomposer.org/installer | php
-    php composer.phar install
-
-Point your webbrowser where use unzipped the download file and follow the configuration instructions.
+    php composer.phar install --no-dev
 
+Rename folder flyspray-1.0-rc9 to shorter name or move to webroot if you want and point your webbrowser there and follow the configuration instructions.
+
 #### Windows users can download Windows installer on https://getcomposer.org/download/
     If you downloaded the installer, make sure to include it to shell when asked.
 
 #### Download vendors
     Using command lines:
     - 'cd' to the main Flyspray directory
     - Type 'php composer.phar install' to automatically download the vendors
-    Users that have it integrated to shell can right click their Flyspray directory and choose "Composer->install" to automatically download the vendors

composer.json

@@ -3,15 +3,18 @@
     "type": "application",
     "description": "The Flyspray bug tracking system.",
     "keywords": ["bug","bugs","tracker","issue","issues", "web"],
-    "homepage": "http://flyspray.org",
+    "homepage": "https://flyspray.org",
     "license": "LGPL-2.1",
     "require": {
         "swiftmailer/swiftmailer": "~5.0",
         "adodb/adodb-php": "~5.20",
-        "jamiebicknell/Sparkline": "1.*",
-        "ezyang/htmlpurifier": "~4.8.0",
+        "jamiebicknell/sparkline": "1.*",
+        "ezyang/htmlpurifier": "~4.12",
         "dapphp/securimage": "3.6.6",
-        "league/oauth2-client": "~0.3|~0.12" 
+        "league/oauth2-client": "~0.12" 
+    },
+    "require-dev": {
+        "phpunit/phpunit": "*"
     },
     "repositories": [
         {

docs/README.txt

@@ -4,7 +4,7 @@ Thanks for downloading version 1.x of Flyspray. For installation
 instructions, take a look at the INSTALL text file. To upgrade from a
 previous version, read the UPGRADING text file.
 
-Flyspray is primarily being developed on Linux (Ubuntu, Debian, OpenSUSE), using Apache 2 and PHP 5 (5.2-5.6)
+Flyspray is primarily being developed on Linux (Ubuntu, Debian, OpenSUSE), using Apache 2 and PHP 7
 To report bugs or request features, use the bug tracking system at
 http://bugs.flyspray.org/ 
 

feed.php

@@ -6,11 +6,11 @@
 define('IN_FS', true);
 define('IN_FEED', true);
 
-require_once(dirname(__FILE__).'/header.php');
+require_once dirname(__FILE__).'/header.php';
 $page = new FSTpl();
 
 // Set up the basic XML head
-header ('Content-type: text/html; charset=utf-8');
+header('Content-Type: application/xml; charset=utf-8');
 
 $max_items  = (Req::num('num', 10) == 10) ? 10 : 20;
 $sql_project = ' 1=1 ';
@@ -93,7 +93,7 @@
 
 /* build a new feed if cache didn't work */
 if($proj->prefs['others_view']){
-    $sql = $db->query("SELECT t.task_id, t.item_summary, t.detailed_desc, t.date_opened, t.date_closed, t.last_edited_time, t.opened_by, 
+    $sql = $db->query("SELECT t.task_id, t.item_summary, t.detailed_desc, t.date_opened, t.date_closed, t.last_edited_time, t.opened_by,
         COALESCE(u.real_name, 'anonymous') AS real_name,
         COALESCE(u.email_address, t.anon_email) AS email_address
         FROM  {tasks}    t
@@ -156,6 +156,5 @@
     }
 }
 
-header('Content-Type: application/xml; charset=utf-8');
 echo $content;
 ?>

includes/class.backend.php

@@ -303,14 +303,15 @@ public static function remove_vote($user_id, $task_id)
      */
     public static function add_comment($task, $comment_text, $time = null)
     {
-        global $conf, $db, $user, $notify, $proj;
+        global $conf, $db, $user, $notify, $proj, $fs;
 
         if (!($user->perms('add_comments', $task['project_id']) && (!$task['is_closed'] || $user->perms('comment_closed', $task['project_id'])))) {
             return false;
         }
 
 	if($conf['general']['syntax_plugin'] != 'dokuwiki'){
 		$purifierconfig = HTMLPurifier_Config::createDefault();
+		if ($fs->prefs['relnofollow']) { $purifierconfig->set('HTML.Nofollow', true); }
 		$purifier = new HTMLPurifier($purifierconfig);
 		$comment_text = $purifier->purify($comment_text);
 	}
@@ -705,6 +706,9 @@ public static function create_user($user_name, $password, $real_name, $jabber_id
                 $newuser[0][$email] = array('recipient' => $email, 'lang' => $fs->prefs['lang_code']);
             }
 
+	    if(is_null($notify)) {
+		    $notify = new Notifications();
+	    }
             // Notify the appropriate users
 			if ($fs->prefs['notify_registration']) {
                 $notify->create(NOTIFY_NEW_USER, null,
@@ -969,7 +973,7 @@ public static function add_reminder($task_id, $message, $how_often, $start_time,
      */
     public static function create_task($args)
     {
-        global $conf, $db, $user, $proj;
+        global $conf, $db, $user, $proj, $fs;
 
         if (!isset($args)) return 0;
 
@@ -1078,6 +1082,7 @@ public static function create_task($args)
 	# dokuwiki syntax plugin filters on output
 	if($conf['general']['syntax_plugin'] != 'dokuwiki' && isset($sql_args['detailed_desc']) ){
 		$purifierconfig = HTMLPurifier_Config::createDefault();
+		if ($fs->prefs['relnofollow']) { $purifierconfig->set('HTML.Nofollow', true); }
 		$purifier = new HTMLPurifier($purifierconfig);
 		$sql_args['detailed_desc'] = $purifier->purify($sql_args['detailed_desc']);
 	}
@@ -1219,7 +1224,7 @@ public static function create_task($args)
 
         if ($user->isAnon()) {
             $anonuser = array();
-            $anonuser[$email] = array('recipient' => $args['anon_email'], 'lang' => $fs->prefs['lang_code']);
+            $anonuser[] = array('recipient' => $args['anon_email']);
             $recipients = array($anonuser);
             $notify->create(NOTIFY_ANON_TASK, $task_id, $token,
                             $recipients, NOTIFY_EMAIL, $proj->prefs['lang_code']);
@@ -1275,7 +1280,7 @@ public static function close_task($task_id, $reason, $comment, $mark100 = true)
                     array($user->id, time(), $task_id, 1));
 
         // duplicate
-        if ($reason == 6) {
+        if ($reason == RESOLUTION_DUPLICATE) {
             preg_match("/\b(?:FS#|bug )(\d+)\b/", $comment, $dupe_of);
             if (count($dupe_of) >= 2) {
                 $existing = $db->query('SELECT * FROM {related} WHERE this_task = ? AND related_task = ? AND is_duplicate = 1',
@@ -1346,6 +1351,7 @@ public static function get_task_list($args, $visible, $offset = 0, $perpage = 20
 	// Keeps the overall logic somewhat simpler.
 	$from .= ' LEFT JOIN {assigned} ass ON t.task_id = ass.task_id';
 	$from .= ' LEFT JOIN {task_tag} tt ON t.task_id = tt.task_id';
+	$from .= ' LEFT JOIN {list_tag} flt ON tt.tag_id = flt.tag_id';
         $cfrom = $from;
 
         // Seems resution name really is needed...
@@ -1479,19 +1485,19 @@ public static function get_task_list($args, $visible, $offset = 0, $perpage = 20
 
 	# not every db system has this feature out of box, it is not standard sql
 	if($conf['database']['dbtype']=='mysqli' || $conf['database']['dbtype']=='mysql'){
-		$select .= ' GROUP_CONCAT(DISTINCT tg.tag_name ORDER BY tg.list_position) AS tags, ';
+		#$select .= ' GROUP_CONCAT(DISTINCT tg.tag_name ORDER BY tg.list_position) AS tags, ';
 		$select .= ' GROUP_CONCAT(DISTINCT tg.tag_id ORDER BY tg.list_position) AS tagids, ';
-		$select .= ' GROUP_CONCAT(DISTINCT tg.class ORDER BY tg.list_position) AS tagclass, ';
+		#$select .= ' GROUP_CONCAT(DISTINCT tg.class ORDER BY tg.list_position) AS tagclass, ';
 	} elseif($conf['database']['dbtype']=='pgsql'){
-		$select .= " array_to_string(array_agg(tg.tag_name ORDER BY tg.list_position), ',') AS tags, ";
+		#$select .= " array_to_string(array_agg(tg.tag_name ORDER BY tg.list_position), ',') AS tags, ";
 		$select .= " array_to_string(array_agg(CAST(tg.tag_id as text) ORDER BY tg.list_position), ',') AS tagids, ";
-		$select .= " array_to_string(array_agg(tg.class ORDER BY tg.list_position), ',') AS tagclass, ";
+		#$select .= " array_to_string(array_agg(tg.class ORDER BY tg.list_position), ',') AS tagclass, ";
 	} else{
 		# unsupported groupconcat or we just do not know how write it for the other databasetypes in this section 
-		$select .= ' MIN(tg.tag_name) AS tags, ';
+		#$select .= ' MIN(tg.tag_name) AS tags, ';
 		#$select .= ' (SELECT COUNT(tt.tag_id) FROM {task_tag} tt WHERE tt.task_id = t.task_id)  AS tagnum, ';
 		$select .= ' MIN(tg.tag_id) AS tagids, ';
-		$select .= " '' AS tagclass, ";
+		#$select .= " '' AS tagclass, ";
 	}
 	// task_tag join table is now always included in join
 	$from .= '
@@ -1741,45 +1747,59 @@ public static function get_task_list($args, $visible, $offset = 0, $perpage = 20
             }
         }
 
-        if (array_get($args, 'string')) {
-            $words = explode(' ', strtr(array_get($args, 'string'), '()', '  '));
-            $comments = '';
-            $where_temp = array();
+		if (array_get($args, 'string')) {
+			$words = explode(' ', strtr(array_get($args, 'string'), '()', '  '));
+			$comments = '';
+			$where_temp = array();
 
-            if (array_get($args, 'search_in_comments')) {
-                $comments .= " OR c.comment_text $LIKEOP ?";
-            }
-            if (array_get($args, 'search_in_details')) {
-                $comments .= " OR t.detailed_desc $LIKEOP ?";
-            }
+			if (array_get($args, 'search_in_comments')) {
+				$comments .= " OR c.comment_text $LIKEOP ?";
+			}
+			if (array_get($args, 'search_in_details')) {
+				$comments .= " OR t.detailed_desc $LIKEOP ?";
+			}
 
-            foreach ($words as $word) {
-                $likeWord = '%' . str_replace('+', ' ', trim($word)) . '%';
-                $where_temp[] = "(t.item_summary $LIKEOP ? OR t.task_id = ? $comments)";
-                array_push($sql_params, $likeWord, intval($word));
-                if (array_get($args, 'search_in_comments')) {
-                    array_push($sql_params, $likeWord);
-                }
-                if (array_get($args, 'search_in_details')) {
-                    array_push($sql_params, $likeWord);
-                }
-            }
+			foreach ($words as $word) {
+				$word = trim($word);
+				if ($word==''){
+					continue;
+				}
 
-            $where[] = '(' . implode((array_get($args, 'search_for_all') ? ' AND ' : ' OR '), $where_temp) . ')';
-        }
+				# The 2006-2020 hidden/undocumented '+' search feature: 'open+source' finds 'open source', but not 'open closed source'
+				if (substr($word, -1) === '+') {
+					# do not replace the + at end of a word like archlinux package name 'memtest86+'
+					$likeWord = '%' . trim(str_replace('+', ' ', substr($word, 0, -1))) . '+%';
+				} else {
+					$likeWord = '%' . trim(str_replace('+', ' ', $word)) . '%';
+				}
+
+				$where_temp[] = "(t.item_summary $LIKEOP ? OR t.task_id = ? OR flt.tag_name $LIKEOP ? $comments)";
+				array_push($sql_params, $likeWord, intval($word), $likeWord);
+				if (array_get($args, 'search_in_comments')) {
+					array_push($sql_params, $likeWord);
+				}
+				if (array_get($args, 'search_in_details')) {
+					array_push($sql_params, $likeWord);
+				}
+			}
 
-	if ($user->isAnon()) {
-		$where[] = 't.mark_private = 0 AND p.others_view = 1';
-		if(array_key_exists('status', $args)){
-			if (in_array('closed', $args['status']) && !in_array('open', $args['status'])) {
-				$where[] = 't.is_closed = 1';
-			} elseif (in_array('open', $args['status']) && !in_array('closed', $args['status'])) {
-				$where[] = 't.is_closed = 0';
+			if(count($where_temp)>0){
+				$where[] = '(' . implode((array_get($args, 'search_for_all') ? ' AND ' : ' OR '), $where_temp) . ')';
+			}
+		}
+
+		if ($user->isAnon()) {
+			$where[] = 't.mark_private = 0 AND p.others_view = 1';
+			if(array_key_exists('status', $args)){
+				if (in_array('closed', $args['status']) && !in_array('open', $args['status'])) {
+					$where[] = 't.is_closed = 1';
+				} elseif (in_array('open', $args['status']) && !in_array('closed', $args['status'])) {
+					$where[] = 't.is_closed = 0';
+				}
 			}
 		}
-	}
 
-        $where = (count($where)) ? 'WHERE ' . join(' AND ', $where) : '';
+		$where = (count($where)) ? 'WHERE ' . join(' AND ', $where) : '';
 
         // Get the column names of table tasks for the group by statement
         if (!strcasecmp($conf['database']['dbtype'], 'pgsql')) {

includes/class.database.php

@@ -227,12 +227,12 @@ public function query($sql, $inputarr = false, $numrows = -1, $offset = -1)
              * cast to integer here anyway */
             $result =  $this->dblink->selectLimit($sql, (int) $numrows, (int) $offset, $inputarr);
         } else {
-           $result =  $this->dblink->execute($sql, $inputarr);
+            $result =  $this->dblink->execute($sql, $inputarr);
         }
 
         if (!$result) {
 
-            if (function_exists("debug_backtrace") && defined('DEBUG_SQL')) {
+            if(function_exists("debug_backtrace") && defined('DEBUG_SQL')) {
                 echo "<pre style='text-align: left;'>";
                 var_dump(debug_backtrace());
                 echo "</pre>";
@@ -241,15 +241,13 @@ public function query($sql, $inputarr = false, $numrows = -1, $offset = -1)
             $query_params = '';
 
             if(is_array($inputarr) && count($inputarr)) {
-
                 $query_params =  implode(',', array_map(array('Filters','noXSS'), $inputarr));
-
             }
 
-            die (sprintf("Query {%s} with params {%s} Failed! (%s)",
-                    Filters::noXSS($sql), $query_params, Filters::noXSS($this->dblink->errorMsg())));
-        }
+            die(sprintf("Query {%s} with params {%s} failed! (%s)",
+                Filters::noXSS($sql), $query_params, Filters::noXSS($this->dblink->errorMsg())));
 
+        }
 
         return $result;
     }