import Planka upstream

planka/server/utils/build-query-parts.js

@@ -0,0 +1,17 @@
+/*!
+ * Copyright (c) 2024 PLANKA Software GmbH
+ * Licensed under the Fair Use License: https://github.com/plankanban/planka/blob/master/LICENSE.md
+ */
+
+const QUERY_PARTS_REGEX = /[ ,;]+/;
+
+const buildQueryParts = (query) =>
+  query.split(QUERY_PARTS_REGEX).flatMap((queryPart) => {
+    if (!queryPart) {
+      return [];
+    }
+
+    return queryPart.toLowerCase();
+  });
+
+module.exports = buildQueryParts;

planka/server/utils/filenamify.js

@@ -0,0 +1,98 @@
+/*
+ * This file derives from https://github.com/sindresorhus/filename-reserved-regex
+ * Licensed under the MIT License:
+ *
+ * Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+function filenameReservedRegex() {
+  return /[<>:"/\\|?*\u0000-\u001F]/g; // eslint-disable-line no-control-regex
+}
+
+function windowsReservedNameRegex() {
+  return /^(con|prn|aux|nul|com\d|lpt\d)$/i;
+}
+
+/*
+ * This file derives from https://github.com/sindresorhus/filenamify
+ * Licensed under the MIT License:
+ *
+ * Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+// Doesn't make sense to have longer filenames
+const MAX_FILENAME_LENGTH = 100;
+
+const reRelativePath = /^\.+(\\|\/)|^\.+$/;
+const reTrailingPeriods = /\.+$/;
+
+function filenamify(string, options = {}) {
+  const reControlChars = /[\u0000-\u001F\u0080-\u009F]/g; // eslint-disable-line no-control-regex
+  const reRepeatedReservedCharacters = /([<>:"/\\|?*\u0000-\u001F]){2,}/g; // eslint-disable-line no-control-regex
+
+  if (typeof string !== 'string') {
+    throw new TypeError('Expected a string');
+  }
+
+  const replacement = options.replacement === undefined ? '!' : options.replacement;
+
+  if (filenameReservedRegex().test(replacement) && reControlChars.test(replacement)) {
+    throw new Error('Replacement string cannot contain reserved filename characters');
+  }
+
+  /* eslint-disable no-param-reassign */
+  if (replacement.length > 0) {
+    string = string.replace(reRepeatedReservedCharacters, '$1');
+  }
+
+  string = string.normalize('NFD');
+  string = string.replace(reRelativePath, replacement);
+  string = string.replace(filenameReservedRegex(), replacement);
+  string = string.replace(reControlChars, replacement);
+  string = string.replace(reTrailingPeriods, '');
+
+  if (replacement.length > 0) {
+    const startedWithDot = string[0] === '.';
+
+    // We removed the whole filename
+    if (!startedWithDot && string[0] === '.') {
+      string = replacement + string;
+    }
+
+    // We removed the whole extension
+    if (string[string.length - 1] === '.') {
+      string += replacement;
+    }
+  }
+
+  string = windowsReservedNameRegex().test(string) ? string + replacement : string;
+  const allowedLength =
+    typeof options.maxLength === 'number' ? options.maxLength : MAX_FILENAME_LENGTH;
+  if (string.length > allowedLength) {
+    const extensionIndex = string.lastIndexOf('.');
+    if (extensionIndex === -1) {
+      string = string.slice(0, allowedLength);
+    } else {
+      const filename = string.slice(0, extensionIndex);
+      const extension = string.slice(extensionIndex);
+      string = filename.slice(0, Math.max(1, allowedLength - extension.length)) + extension;
+    }
+  }
+  /* eslint-enable no-param-reassign */
+
+  return string;
+}
+
+module.exports = filenamify;

planka/server/utils/inputs.js

@@ -0,0 +1,31 @@
+/*!
+ * Copyright (c) 2024 PLANKA Software GmbH
+ * Licensed under the Fair Use License: https://github.com/plankanban/planka/blob/master/LICENSE.md
+ */
+
+const {
+  ID_REGEX,
+  IDS_WITH_COMMA_REGEX,
+  MAX_STRING_ID,
+  isIdInRange,
+  isIdsWithCommaInRange,
+} = require('./validators');
+
+const idInput = {
+  type: 'string',
+  maxLength: MAX_STRING_ID.length,
+  regex: ID_REGEX,
+  custom: isIdInRange,
+};
+
+const idsInput = {
+  type: 'string',
+  maxLength: MAX_STRING_ID.length * 100 + 99,
+  regex: IDS_WITH_COMMA_REGEX,
+  custom: isIdsWithCommaInRange,
+};
+
+module.exports = {
+  idInput,
+  idsInput,
+};

planka/server/utils/logger.js

@@ -0,0 +1,47 @@
+/*!
+ * Copyright (c) 2024 PLANKA Software GmbH
+ * Licensed under the Fair Use License: https://github.com/plankanban/planka/blob/master/LICENSE.md
+ */
+
+const winston = require('winston');
+
+/**
+ * The default timestamp used by the logger.
+ * Format example: "2022-08-18 6:30:02"
+ */
+const defaultLogTimestampFormat = 'YYYY-MM-DD HH:mm:ss';
+
+/**
+ * Log level for both console and file log sinks.
+ *
+ * Refer {@link https://github.com/winstonjs/winston#logging here}
+ * for more information on Winston log levels.
+ */
+const logLevel = process.env.LOG_LEVEL || 'warn';
+
+const logFormat = winston.format.combine(
+  winston.format.uncolorize(),
+  winston.format.timestamp({ format: defaultLogTimestampFormat }),
+  winston.format.printf((log) => `${log.timestamp} [${log.level[0].toUpperCase()}] ${log.message}`),
+);
+
+const logFile = process.env.LOG_FILE || `${process.cwd()}/logs/planka.log`;
+
+// eslint-disable-next-line new-cap
+const customLogger = new winston.createLogger({
+  transports: [
+    new winston.transports.File({
+      level: logLevel,
+      format: logFormat,
+      filename: logFile,
+    }),
+    new winston.transports.Console({
+      level: logLevel,
+      format: logFormat,
+    }),
+  ],
+});
+
+module.exports = {
+  customLogger,
+};

planka/server/utils/mentions.js

@@ -0,0 +1,20 @@
+/*!
+ * Copyright (c) 2024 PLANKA Software GmbH
+ * Licensed under the Fair Use License: https://github.com/plankanban/planka/blob/master/LICENSE.md
+ */
+
+const MENTION_ID_REGEX = /@\[.*?\]\((.*?)\)/g;
+const MENTION_USERNAME_REGEX = /@\[(.*?)\]\(.*?\)/g;
+
+const extractMentionIds = (text) => {
+  const matches = [...text.matchAll(MENTION_ID_REGEX)];
+  return matches.map((match) => match[1]);
+};
+
+const mentionMarkupToText = (markup) =>
+  markup.replace(MENTION_USERNAME_REGEX, (_, username) => `@${username}`);
+
+module.exports = {
+  extractMentionIds,
+  mentionMarkupToText,
+};

planka/server/utils/migrations.js

@@ -0,0 +1,54 @@
+/*!
+ * Copyright (c) 2024 PLANKA Software GmbH
+ * Licensed under the Fair Use License: https://github.com/plankanban/planka/blob/master/LICENSE.md
+ */
+
+const { POSITION_GAP } = require('../constants');
+
+const addPosition = async (knex, tableName, parentFieldName) => {
+  await knex.schema.table(tableName, (table) => {
+    /* Columns */
+
+    table.specificType('position', 'double precision');
+
+    /* Indexes */
+
+    table.index('position');
+  });
+
+  const records = await knex(tableName).orderBy([parentFieldName, 'id']);
+
+  let prevParentId;
+  let position;
+
+  // eslint-disable-next-line no-restricted-syntax
+  for (record of records) {
+    if (record[parentFieldName] === prevParentId) {
+      position += POSITION_GAP;
+    } else {
+      prevParentId = record[parentFieldName];
+      position = POSITION_GAP;
+    }
+
+    // eslint-disable-next-line no-await-in-loop
+    await knex(tableName)
+      .update({
+        position,
+      })
+      .where('id', record.id);
+  }
+
+  return knex.schema.table(tableName, (table) => {
+    table.dropNullable('position');
+  });
+};
+
+const removePosition = (knex, tableName) =>
+  knex.schema.table(tableName, (table) => {
+    table.dropColumn('position');
+  });
+
+module.exports = {
+  addPosition,
+  removePosition,
+};

planka/server/utils/normalize-values.js

@@ -0,0 +1,44 @@
+/*!
+ * Copyright (c) 2024 PLANKA Software GmbH
+ * Licensed under the Fair Use License: https://github.com/plankanban/planka/blob/master/LICENSE.md
+ */
+
+const normalizeValues = (rules, values, record) => {
+  if (record) {
+    // eslint-disable-next-line no-param-reassign
+    values = {
+      ...record,
+      ...values,
+    };
+  }
+
+  return Object.entries(rules).reduce((result, [fieldName, { setTo, defaultTo }]) => {
+    let value = values[fieldName];
+
+    if (!_.isUndefined(setTo)) {
+      const setToValue = _.isFunction(setTo) ? setTo(values) : setTo;
+
+      if (!_.isUndefined(setToValue)) {
+        value = setToValue;
+      }
+    }
+
+    if (!_.isUndefined(defaultTo) && _.isNil(value)) {
+      const defaultToValue = _.isFunction(defaultTo) ? defaultTo(values) : defaultTo;
+
+      if (!_.isUndefined(defaultToValue)) {
+        value = defaultToValue;
+      }
+    }
+
+    if (!_.isUndefined(value)) {
+      if (!record || value !== record[fieldName]) {
+        result[fieldName] = value; // eslint-disable-line no-param-reassign
+      }
+    }
+
+    return result;
+  }, {});
+};
+
+module.exports = normalizeValues;

planka/server/utils/remote-address.js

@@ -0,0 +1,32 @@
+/*!
+ * Copyright (c) 2024 PLANKA Software GmbH
+ * Licensed under the Fair Use License: https://github.com/plankanban/planka/blob/master/LICENSE.md
+ */
+
+/**
+ * The IP address of the client that just made a request to this application, whether
+ * or not the TRUST_PROXY env variable is true and if endpoint accessed through a proxy.
+ * @param {Request} request The endpoint Request object
+ * @returns The IP address of the client that just made a request
+ */
+const getRemoteAddress = (request) => {
+  let remoteAddress = request.ip;
+
+  // Assert if "X-Forwarded-For" header contains any addresses
+  if (process.env.TRUST_PROXY === 'true' && !_.isEmpty(request.ips)) {
+    // eslint-disable-next-line prefer-destructuring
+    remoteAddress = request.ips[0];
+  }
+
+  // Convert address from IPV6 to IPV4 if client device is IPV4.
+  const defaultIPV6Regex = /^::ffff:((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\.?\b){4}$/g;
+  if (remoteAddress.match(defaultIPV6Regex)) {
+    remoteAddress = remoteAddress.replace('::ffff:', '');
+  }
+
+  return remoteAddress;
+};
+
+module.exports = {
+  getRemoteAddress,
+};

planka/server/utils/send_notifications.py

@@ -0,0 +1,75 @@
+# Copyright (c) 2024 PLANKA Software GmbH
+# Licensed under the Fair Use License: https://github.com/plankanban/planka/blob/master/LICENSE.md
+
+import sys
+import json
+import logging
+import apprise
+
+
+BLOCKED_SCHEMAS_SET = {
+    'syslog',
+    'dbus',
+    'kde',
+    'qt',
+    'glib',
+    'gnome',
+    'macosx',
+    'windows',
+}
+
+
+last_apprise_message = None
+class CaptureWarningHandler(logging.Handler):
+    def emit(self, record):
+        global last_apprise_message
+        last_apprise_message = record.getMessage()
+
+
+capture_warning_handler = CaptureWarningHandler()
+capture_warning_handler.setLevel(logging.WARNING)
+
+apprise_logger = logging.getLogger('apprise')
+apprise_logger.setLevel(logging.WARNING)
+apprise_logger.propagate = False
+apprise_logger.addHandler(capture_warning_handler)
+
+
+def send_notification(url, title, body, body_format):
+    app = apprise.Apprise()
+    app.add(url)
+    return app.notify(title=title, body=body, body_format=body_format)
+
+
+if __name__ == '__main__':
+    services = json.loads(sys.argv[1])
+    title = sys.argv[2]
+    body_by_format = json.loads(sys.argv[3])
+
+    errors = []
+    for service in services:
+        url = service['url']
+        schema = url.split(':')[0]
+
+        if schema in BLOCKED_SCHEMAS_SET:
+            errors.append(f'[{schema}] Blocked service schema')
+            continue
+
+        body_format = service['format']
+        body = body_by_format[body_format]
+
+        last_apprise_message = None
+        if not send_notification(url, title, body, body_format):
+            if last_apprise_message:
+                if last_apprise_message == 'There are no service(s) to notify':
+                    errors.append(f'[{schema}] Unknown service URL')
+                else:
+                    errors.append(f'[{schema}] {last_apprise_message}')
+            else:
+                errors.append(f'[{schema}] Unknown error')
+
+    if errors:
+        for error in errors:
+            print(error, file=sys.stderr)
+
+        sys.exit(1)

planka/server/utils/validators.js

@@ -0,0 +1,76 @@
+/*!
+ * Copyright (c) 2024 PLANKA Software GmbH
+ * Licensed under the Fair Use License: https://github.com/plankanban/planka/blob/master/LICENSE.md
+ */
+
+const validator = require('validator');
+const zxcvbn = require('zxcvbn');
+const moment = require('moment');
+
+const MAX_STRING_ID = '9223372036854775807';
+
+const ID_REGEX = /^[1-9][0-9]*$/;
+const IDS_WITH_COMMA_REGEX = /^[1-9][0-9]*(,[1-9][0-9]*)*$/;
+const USERNAME_REGEX = /^[a-zA-Z0-9]+((_|\.)?[a-zA-Z0-9])*$/;
+
+const is = (defaultValue) => (value) => value === defaultValue;
+
+const isUrl = (value) =>
+  validator.isURL(value, {
+    protocols: ['http', 'https'],
+    require_tld: false,
+    require_protocol: true,
+  });
+
+const isIdInRange = (value) => value.length < MAX_STRING_ID.length || value <= MAX_STRING_ID;
+
+const isIdsWithCommaInRange = (value) => _.every(value.split(','), isIdInRange);
+
+const isId = (value) =>
+  value.length <= MAX_STRING_ID.length && ID_REGEX.test(value) && isIdInRange(value);
+
+const isIds = (values) => _.every(values, isId);
+
+const isPassword = (value) => zxcvbn(value).score >= 2; // TODO: move to config
+
+const isEmailOrUsername = (value) =>
+  value.includes('@')
+    ? validator.isEmail(value)
+    : value.length >= 3 && value.length <= 32 && USERNAME_REGEX.test(value);
+
+const isDueDate = (value) => moment(value, moment.ISO_8601, true).isValid();
+
+const isStopwatch = (value) => {
+  if (!_.isPlainObject(value) || _.size(value) !== 2) {
+    return false;
+  }
+
+  if (!_.isNull(value.startedAt) && !moment(value.startedAt, moment.ISO_8601, true).isValid()) {
+    return false;
+  }
+
+  if (!_.isFinite(value.total) || value.total < 0) {
+    return false;
+  }
+
+  return true;
+};
+
+module.exports = {
+  MAX_STRING_ID,
+
+  ID_REGEX,
+  IDS_WITH_COMMA_REGEX,
+  USERNAME_REGEX,
+
+  is,
+  isUrl,
+  isIdInRange,
+  isIdsWithCommaInRange,
+  isId,
+  isIds,
+  isPassword,
+  isEmailOrUsername,
+  isDueDate,
+  isStopwatch,
+};