diff --git a/.dockerignore b/.dockerignore new file mode 100644 index 000000000..3e14f8929 --- /dev/null +++ b/.dockerignore @@ -0,0 +1,36 @@ + +# Ignore git directory. +/.git + +# Ignore bundle config. +/.bundle + +# Ignore environment and deployment files. +/.env* +/.kamal/* +/config/deploy.yml + +# Ignore all logfiles and tempfiles. +/log/* +/tmp/* +!/log/.keep +!/tmp/.keep + +# Ignore pidfiles. +/tmp/pids/* +!/tmp/pids/.keep + +# Ignore storage. +/storage/* +!/storage/.keep +/tmp/storage/* +!/tmp/storage/.keep + +# Ignore assets. +/public/assets + +# Ignore applicaiton folders +/attachments/ +/config/shared/* +/db/*.sqlite3 +/templates/* diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b716784f8..99c8e3c9f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,7 +18,7 @@ jobs: with: bundler-cache: true - name: Security audit dependencies - run: bundle exec bundler-audit --update + run: bundle exec bundler-audit --update --ignore CVE-2023-31606 CVE-2023-50724 CVE-2023-50725 CVE-2023-50727 - name: Security audit ruby run: bundle exec ruby-audit update && bundle exec ruby-audit check --ignore CVE-2021-33621 - name: Security audit application code @@ -48,15 +48,15 @@ jobs: RAILS_ENV: test steps: - name: Checkout code - uses: actions/checkout@v3 + uses: actions/checkout@v4 - name: Create database.yml run: cp config/database.yml.template config/database.yml - name: Install Ruby and gems uses: ruby/setup-ruby@v1 with: bundler-cache: true - - name: Load database schema - run: bundle exec rails db:schema:load + - name: Prepare database + run: bundle exec rails db:prepare - name: Precompile assets run: bundle exec rails assets:precompile - name: Run tests diff --git a/.gitignore b/.gitignore index d63e5a4fd..5c5937fc1 100644 --- a/.gitignore +++ b/.gitignore @@ -24,6 +24,11 @@ # RSpec testing /spec/.examples.txt +# Ignore environment and deployment files +/.env* +/.kamal/* +/config/deploy.yml + # App-specific /attachments/ /backup/ diff --git a/CHANGELOG b/CHANGELOG index caaa51411..c7537d37e 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -2,9 +2,10 @@ - [entity]: - [future tense verb] [feature] - Upgraded gems: - - [gem] + - nokogiri, rails - Bugs fixes: - Digital Ocean: Fix one click deploy button + - Tylium: Fix redirection when updating an issue or content block - Bug tracker items: - [item] - New integrations: @@ -25,6 +26,65 @@ - Medium: (Authenticated|Unauthenticated) (admin|author|contributor) [vulnerability description] - Low: (Authenticated|Unauthenticated) (admin|author|contributor) [vulnerability description] +v4.11.0 (January 2024) + - Assets: Add importmap-rails to handle js libraries + - Liquid: Add LiquidAssignsService + - Revision history: Improve version history for content with carriage return + - Tylium: Show liquid content in editor preview + - Web-server: Replace unicorn with puma in production + - Note: Enable ActiveSupport load hooks + - Upgraded gems: + - rails + - Bugs fixes: + - Evidence: Prevent loading old Evidence template content at the Issue level + - Methodologies: validate presence of content + - Integration enhancements: + - Burp: Change nokogiri search to xpath to support nokogiri >= 1.15 + - Nexpose: + - Add port/protocol to evidences + - Use the details in as the OS node property + - Import `vulnerability.risk_score` as a new Issue field + - Allow multiple evidence with the same test id & node address + - Qualys: Add support for the output for Qualys WAS API 3.13 and later + - Security Fixes: + - Low: Authenticated (author) information disclosure + - After a user has been removed from a project, they may still get + notifications for Issues they were subscribed to, resulting in the + disclosure of Issue titles. + - Low: Authenticated (author) information disclosure in the output console of upload manager + +v4.10.0 (September 2023) + - Tylium: + - Consolidate sidebars + - Add issue.author to liquid issue drop + - Upgraded gems: + - font-awesome-sass, nokogiri, puma, rails, sanitize, selenium-webdriver + - Bugs fixes: + - QA: Enable @mentions and formatting toolbar for comments in QA show views + - REST/JSON API enhancements: + - Boards, Lists, Cards: add initial implementation + - Security Fixes: + - Medium: Authenticated (author) broken access control: read access to system files + +v4.9.0 (June 2023) + - Tylium: Extend support for Liquid Dynamic Content + - QA: Show state changes in activity feed + - Upgraded gems: + - bootstrap, popper_js, simple_form + - Bugs fixes: + - QA: Redirect to correct view when changing states on QA edit views + - Integration enhancements: + - Acunetix: Parse inline code, not just code blocks + - Burp: Adds strong and code tags parsing + - CSV: Fix CSV Upload for files with special characters + - Nessus: + - Parse code tags as inline code + - Add plugin_type as an available Issue field + - Nexpose: + - Parse inline code, not just code blocks + - Wrap ciphers in the `ssl-weak-message-authentication-code-algorithms` finding + - Qualys: Adds Request/Response Evidence fields for Web Application Scans (WAS) + v4.8.0 (April 2023) - Sessions: Store :secret_key_base in encrypted configuration file - Quality Assurance: Review/approve Issues and Content Blocks before including them in reports @@ -198,6 +258,8 @@ v4.1.0 (November 2021) - Remove orphaned tags - Security Fixes: - High: Authenticated author broken access control: read access to issue content + - Medium: (Authenticated|Unauthenticated) (admin|author|contributor) [vulnerability description] + - Low: (Authenticated|Unauthenticated) (admin|author|contributor) [vulnerability description] v4.0.0 (July 2021) * Dynamic content across the app diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index dbb151bdd..e4d6516ac 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -49,6 +49,7 @@ top of things. http://securityreactions.tumblr.com/post/31726556638/we-have-an-ids-and-a-waf ```` +* Add a CHANGELOG entry. * Make sure you have added the necessary tests for your changes. * Run _all_ the tests to assure nothing else was accidentally broken. * Adhere to our [style guides](https://github.com/dradis/dradis-ce/wiki). @@ -56,9 +57,10 @@ top of things. ## Submitting Changes -* Review our [Contributor's Agreement](https://github.com/dradis/dradis-ce/wiki/Contributor%27s-agreement). Sending us a pull request means you have read and accept to this agreement +* Review our [Contributor's Agreement](https://github.com/dradis/dradis-ce/wiki/Contributor%27s-agreement). Sending us a pull request means you have read and accepted this agreement * Push your changes to a topic branch in your fork of the repository. * Submit a **pull request** to the repository in the dradis organization. +* Ensure you include testing steps in your pull request * Include a link to the pull request in the ticket diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 000000000..6b874c8d0 --- /dev/null +++ b/Dockerfile @@ -0,0 +1,39 @@ +# We're sticking to non-slim version: https://hub.docker.com/_/ruby/ +FROM --platform=amd64 ruby:3.1.2 + +WORKDIR /app + +# Copying dradis-ce app +COPY . . + +# Copying sample files +COPY config/database.yml.template config/database.yml +COPY config/smtp.yml.template config/smtp.yml + +# Preparing application folders +RUN mkdir -p attachments/ +RUN mkdir -p config/shared/ +RUN mkdir -p templates/ + +# Is this only needed because M1 build? +RUN bundle config build.ffi --enable-libffi-alloc + +# Installing dependencies +RUN bundle install + +# Run and own only the runtime files as a non-root user for security +RUN useradd rails --create-home --shell /bin/bash && \ + chown -R rails:rails attachments config/shared db log tmp templates +USER rails:rails + +# Preparing database +RUN bin/rails db:prepare +#RUN bin/rails db:seed + +# Entrypoint prepares the database. +# ENTRYPOINT ["/app/bin/docker-entrypoint"] + +# Start the server by default, this can be overwritten at runtime +EXPOSE 3000 +# CMD ["./bin/rails", "server"] +CMD ["bundle", "exec", "rails", "server", "-b", "0.0.0.0"] diff --git a/Gemfile b/Gemfile index 952fd3f47..47d939706 100644 --- a/Gemfile +++ b/Gemfile @@ -5,13 +5,13 @@ git_source(:github) { |repo| "https://github.com/#{repo}.git" } ruby '3.1.2' # Bundle edge Rails instead: gem 'rails', github: 'rails/rails' -gem 'rails', '~> 6.1.7.3' +gem 'rails', '~> 7.0.8' # Use SCSS for stylesheets gem 'sass-rails', '~> 6.0' -# Use Uglifier as compressor for JavaScript assets -gem 'uglifier', '>= 1.3.0' +# Use ruby-terser as compressor for JavaScript assets +gem 'terser', '~> 1.1' # See https://github.com/rails/execjs#readme for more supported runtimes gem 'mini_racer', platforms: :ruby @@ -35,9 +35,8 @@ gem 'jbuilder', '~> 2.7' gem 'bootsnap', '>= 1.12.0', require: false # ---------------------------------------------------- Dradis Community Edition -gem 'bootstrap', '~> 4.3.1' +gem 'bootstrap', '~> 5.2.3' gem 'jquery-rails' -gem 'jquery-ui-rails' gem 'jquery-fileupload-rails', '~> 0.3.4' gem 'jquery-hotkeys-rails' @@ -67,6 +66,12 @@ gem 'thor', '~> 1.2.1' # Ruby dependency, version specified here due to CVE-2023-28756 gem 'time', '>= 0.2.2' +gem 'font-awesome-sass', '~> 6.4.0' + +gem 'importmap-rails', '~> 1.2' + +gem 'sprockets-rails', '>= 3.0.0' + # ------------------------------------------------------ With native extensions # These require native extensions. # Ensure Traveling Ruby provides an appropriate version before bumping. @@ -81,7 +86,7 @@ gem 'bcrypt', '3.1.12' gem 'json', '2.3.0' # XML manipulation -gem 'nokogiri', '>= 1.14.3' +gem 'nokogiri', '>= 1.16.2' # MySQL backend # gem 'mysql2', '~> 0.5.1' @@ -99,7 +104,7 @@ gem 'RedCloth', '~> 4.3.2', require: 'redcloth' gem 'rinku' # html-pipeline dependency for html sanitization -gem 'sanitize', '6.0.1' +gem 'sanitize', '6.0.2' # SQLite3 DB driver gem 'sqlite3' @@ -136,17 +141,12 @@ gem 'net-imap' gem 'matrix' -gem 'puma', '~> 5.0' +gem 'puma', '>= 6.4.2' # ------------------------------------------------------------------ Deployment # Use Capistrano for deployment # gem 'capistrano-rails', group: :development -group :production do - # Use Unicorn as the web server - gem 'unicorn', '6.1.0' -end - # ----------------------------------------------------- Development and Testing group :development do # Access an interactive console on exception pages or by calling 'console' anywhere in the code. @@ -154,7 +154,7 @@ group :development do # Display performance information such as SQL time and flame graphs for each request in your browser. # Can be configured to work on production as well see: https://github.com/MiniProfiler/rack-mini-profiler/blob/master/README.md gem 'rack-mini-profiler', '~> 2.0' - gem 'listen', '~> 3.3' + gem 'listen' # Spring speeds up development by keeping your application running in the background. Read more: https://github.com/rails/spring gem 'spring' @@ -190,12 +190,11 @@ end group :test do gem 'database_cleaner' gem 'factory_bot_rails' - gem 'capybara', '>= 3.26' + gem 'capybara', '~> 3.39' gem 'guard-rspec', require: false - gem 'selenium-webdriver' + gem 'selenium-webdriver', '~> 4.17' gem 'shoulda-matchers', '~> 3.1' gem 'timecop' - gem 'webdrivers' # Required by capybara gem 'matrix' @@ -216,12 +215,12 @@ end # # Base framework classes required by other plugins -gem 'dradis-plugins', '~> 4.8.0' +gem 'dradis-plugins', github: 'dradis/dradis-plugins', branch: 'fix/template-caching' gem 'dradis-api', path: 'engines/dradis-api' # Import / export project data -gem 'dradis-projects', '~> 4.8.0' +gem 'dradis-projects', '~> 4.11.0' plugins_file = 'Gemfile.plugins' if File.exists?(plugins_file) @@ -232,32 +231,33 @@ end # effective. # ----------------------------------------------------------------- Calculators -gem 'dradis-calculator_cvss', '~> 4.8.0' -gem 'dradis-calculator_dread', '~> 4.8.0' + +gem 'dradis-calculator_cvss', '~> 4.11.0' +gem 'dradis-calculator_dread', '~> 4.11.0' # ---------------------------------------------------------------------- Export -gem 'dradis-csv_export', '~> 4.8.0' -gem 'dradis-html_export', '~> 4.8.0' +gem 'dradis-csv_export', '~> 4.11.0' +gem 'dradis-html_export', '~> 4.11.0' # ---------------------------------------------------------------------- Import -gem 'dradis-csv', '~> 4.8.0' +gem 'dradis-csv', '~> 4.11.0' # ---------------------------------------------------------------------- Upload -gem 'dradis-acunetix', '~> 4.8.0' -gem 'dradis-brakeman', '~> 4.8.0' -gem 'dradis-burp', '~> 4.8.0' -gem 'dradis-coreimpact', '~> 4.8.0' -gem 'dradis-metasploit', '~> 4.8.0' -gem 'dradis-nessus', '~> 4.8.0' -gem 'dradis-netsparker', '~> 4.8.0' -gem 'dradis-nexpose', '~> 4.8.0' -gem 'dradis-nikto', '~> 4.8.0' -gem 'dradis-nipper', '~> 4.8.0' -gem 'dradis-nmap', '~> 4.8.0' -gem 'dradis-ntospider', '~> 4.8.0' -gem 'dradis-openvas', '~> 4.8.0' -gem 'dradis-qualys', '~> 4.8.0' -gem 'dradis-saint', '~> 4.8.0' -gem 'dradis-veracode', '~> 4.8.0' -gem 'dradis-wpscan', '~> 4.8.0' -gem 'dradis-zap', '~> 4.8.0' +gem 'dradis-acunetix', '~> 4.11.0' +gem 'dradis-brakeman', '~> 4.11.0' +gem 'dradis-burp', '~> 4.11.0' +gem 'dradis-coreimpact', '~> 4.11.0' +gem 'dradis-metasploit', '~> 4.11.0' +gem 'dradis-nessus', '~> 4.11.0' +gem 'dradis-netsparker', '~> 4.11.0' +gem 'dradis-nexpose', '~> 4.11.0' +gem 'dradis-nikto', '~> 4.11.0' +gem 'dradis-nipper', '~> 4.11.0' +gem 'dradis-nmap', '~> 4.11.0' +gem 'dradis-ntospider', '~> 4.11.0' +gem 'dradis-openvas', '~> 4.11.0' +gem 'dradis-qualys', '~> 4.11.0' +gem 'dradis-saint', '~> 4.11.0' +gem 'dradis-veracode', '~> 4.11.0' +gem 'dradis-wpscan', '~> 4.11.0' +gem 'dradis-zap', '~> 4.11.0' diff --git a/Gemfile.lock b/Gemfile.lock index 2d8d1f4f0..fa8383c98 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -1,87 +1,101 @@ +GIT + remote: https://github.com/dradis/dradis-plugins.git + revision: e69d1f42c85f647662307019b8b492152a5c3c29 + branch: fix/template-caching + specs: + dradis-plugins (4.11.0) + PATH remote: engines/dradis-api specs: - dradis-api (4.8.0) + dradis-api (4.11.0) jbuilder GEM remote: https://rubygems.org/ specs: RedCloth (4.3.2) - actioncable (6.1.7.3) - actionpack (= 6.1.7.3) - activesupport (= 6.1.7.3) + actioncable (7.0.8.1) + actionpack (= 7.0.8.1) + activesupport (= 7.0.8.1) nio4r (~> 2.0) websocket-driver (>= 0.6.1) - actionmailbox (6.1.7.3) - actionpack (= 6.1.7.3) - activejob (= 6.1.7.3) - activerecord (= 6.1.7.3) - activestorage (= 6.1.7.3) - activesupport (= 6.1.7.3) + actionmailbox (7.0.8.1) + actionpack (= 7.0.8.1) + activejob (= 7.0.8.1) + activerecord (= 7.0.8.1) + activestorage (= 7.0.8.1) + activesupport (= 7.0.8.1) mail (>= 2.7.1) - actionmailer (6.1.7.3) - actionpack (= 6.1.7.3) - actionview (= 6.1.7.3) - activejob (= 6.1.7.3) - activesupport (= 6.1.7.3) + net-imap + net-pop + net-smtp + actionmailer (7.0.8.1) + actionpack (= 7.0.8.1) + actionview (= 7.0.8.1) + activejob (= 7.0.8.1) + activesupport (= 7.0.8.1) mail (~> 2.5, >= 2.5.4) + net-imap + net-pop + net-smtp rails-dom-testing (~> 2.0) - actionpack (6.1.7.3) - actionview (= 6.1.7.3) - activesupport (= 6.1.7.3) - rack (~> 2.0, >= 2.0.9) + actionpack (7.0.8.1) + actionview (= 7.0.8.1) + activesupport (= 7.0.8.1) + rack (~> 2.0, >= 2.2.4) rack-test (>= 0.6.3) rails-dom-testing (~> 2.0) rails-html-sanitizer (~> 1.0, >= 1.2.0) - actiontext (6.1.7.3) - actionpack (= 6.1.7.3) - activerecord (= 6.1.7.3) - activestorage (= 6.1.7.3) - activesupport (= 6.1.7.3) + actiontext (7.0.8.1) + actionpack (= 7.0.8.1) + activerecord (= 7.0.8.1) + activestorage (= 7.0.8.1) + activesupport (= 7.0.8.1) + globalid (>= 0.6.0) nokogiri (>= 1.8.5) - actionview (6.1.7.3) - activesupport (= 6.1.7.3) + actionview (7.0.8.1) + activesupport (= 7.0.8.1) builder (~> 3.1) erubi (~> 1.4) rails-dom-testing (~> 2.0) rails-html-sanitizer (~> 1.1, >= 1.2.0) - activejob (6.1.7.3) - activesupport (= 6.1.7.3) + activejob (7.0.8.1) + activesupport (= 7.0.8.1) globalid (>= 0.3.6) - activemodel (6.1.7.3) - activesupport (= 6.1.7.3) - activerecord (6.1.7.3) - activemodel (= 6.1.7.3) - activesupport (= 6.1.7.3) - activestorage (6.1.7.3) - actionpack (= 6.1.7.3) - activejob (= 6.1.7.3) - activerecord (= 6.1.7.3) - activesupport (= 6.1.7.3) + activemodel (7.0.8.1) + activesupport (= 7.0.8.1) + activerecord (7.0.8.1) + activemodel (= 7.0.8.1) + activesupport (= 7.0.8.1) + activestorage (7.0.8.1) + actionpack (= 7.0.8.1) + activejob (= 7.0.8.1) + activerecord (= 7.0.8.1) + activesupport (= 7.0.8.1) marcel (~> 1.0) mini_mime (>= 1.1.0) - activesupport (6.1.7.3) + activesupport (7.0.8.1) concurrent-ruby (~> 1.0, >= 1.0.2) i18n (>= 1.6, < 2) minitest (>= 5.1) tzinfo (~> 2.0) - zeitwerk (~> 2.3) acts_as_tree (2.9.1) activerecord (>= 3.0.0) - addressable (2.8.0) - public_suffix (>= 2.0.2, < 5.0) + addressable (2.8.5) + public_suffix (>= 2.0.2, < 6.0) ast (2.4.2) - autoprefixer-rails (9.7.4) - execjs + autoprefixer-rails (10.4.13.0) + execjs (~> 2) + base64 (0.2.0) bcrypt (3.1.12) bindex (0.8.1) blankslate (3.1.3) bootsnap (1.12.0) msgpack (~> 1.2) - bootstrap (4.3.1) + bootstrap (5.2.3) autoprefixer-rails (>= 9.1.0) - popper_js (>= 1.14.3, < 2) + popper_js (>= 2.11.6, < 3) sassc-rails (>= 2.0.0) brakeman (5.4.0) builder (3.2.4) @@ -90,15 +104,15 @@ GEM thor (~> 1.0) byebug (11.1.1) cancancan (1.17.0) - capybara (3.35.3) + capybara (3.39.2) addressable + matrix mini_mime (>= 0.1.3) nokogiri (~> 1.8) rack (>= 1.6.0) rack-test (>= 0.6.3) regexp_parser (>= 1.5, < 3.0) xpath (~> 3.2) - childprocess (3.0.0) chronic (0.10.2) coderay (1.1.2) coffee-rails (5.0.0) @@ -112,77 +126,76 @@ GEM activesupport (>= 3.0.0) railties (>= 3.0.0) thor (>= 0.14.6) - concurrent-ruby (1.2.2) + concurrent-ruby (1.2.3) crass (1.0.6) database_cleaner (1.8.2) - date (3.3.3) + date (3.3.4) diff-lcs (1.5.0) differ (0.1.2) - dradis-acunetix (4.8.0) + dradis-acunetix (4.11.0) dradis-plugins (~> 4.0) nokogiri (~> 1.3) - dradis-brakeman (4.8.0) + dradis-brakeman (4.11.0) dradis-plugins (~> 4.0) - dradis-burp (4.8.0) + dradis-burp (4.11.0) dradis-plugins (~> 4.0) nokogiri (~> 1.3) - dradis-calculator_cvss (4.8.0) + dradis-calculator_cvss (4.11.0) dradis-plugins (~> 4.0) - dradis-calculator_dread (4.8.0) + dradis-calculator_dread (4.11.0) dradis-plugins (~> 4.0) - dradis-coreimpact (4.8.0) + dradis-coreimpact (4.11.0) dradis-plugins (~> 4.0) - dradis-csv (4.8.0) + dradis-csv (4.11.0) dradis-plugins (~> 4.0) - dradis-csv_export (4.8.0) + dradis-csv_export (4.11.0) dradis-plugins (>= 4.8.0) - dradis-html_export (4.8.0) + dradis-html_export (4.11.1) RedCloth (~> 4.3.2) dradis-plugins (>= 4.8.0) rails_autolink (~> 1.1) - dradis-metasploit (4.8.0) + dradis-metasploit (4.11.0) dradis-plugins (~> 4.0) nokogiri (~> 1.3) - dradis-nessus (4.8.0) + dradis-nessus (4.11.0) dradis-plugins (~> 4.0) nokogiri - dradis-netsparker (4.8.0) + dradis-netsparker (4.11.0) dradis-plugins (~> 4.0) nokogiri (>= 1.12.5) - dradis-nexpose (4.8.0) + dradis-nexpose (4.11.0) dradis-plugins (~> 4.0) nokogiri (~> 1.3) - dradis-nikto (4.8.0) + dradis-nikto (4.11.0) dradis-plugins (~> 4.0) nokogiri (~> 1.3) - dradis-nipper (4.8.0) + dradis-nipper (4.11.0) dradis-plugins (~> 4.0) - dradis-nmap (4.8.0) + dradis-nmap (4.11.0) dradis-plugins (~> 4.0) ruby-nmap (~> 0.7) - dradis-ntospider (4.8.0) + dradis-ntospider (4.11.0) dradis-plugins (~> 4.0) - dradis-openvas (4.8.0) + dradis-openvas (4.11.0) dradis-plugins (~> 4.0) - dradis-plugins (4.8.0) - dradis-projects (4.8.0) + dradis-projects (4.11.0) dradis-plugins (>= 4.8.0) rubyzip - dradis-qualys (4.8.0) + dradis-qualys (4.11.0) dradis-plugins (~> 4.0) nokogiri (~> 1.3) - dradis-saint (4.8.0) + dradis-saint (4.11.0) combustion (~> 0.6.0) dradis-plugins (~> 4.0) nokogiri rake (~> 13.0) rspec-rails - dradis-veracode (4.8.0) + dradis-veracode (4.11.0) dradis-plugins (~> 4.0) - dradis-wpscan (4.8.0) + dradis-wpscan (4.11.0) dradis-plugins (~> 4.0) multi_json - dradis-zap (4.8.0) + dradis-zap (4.11.0) dradis-plugins (~> 4.0) nokogiri (~> 1.3) erubi (1.12.0) @@ -192,11 +205,13 @@ GEM factory_bot_rails (6.2.0) factory_bot (~> 6.2.0) railties (>= 5.0.0) - ffi (1.14.2) + ffi (1.15.5) + font-awesome-sass (6.4.0) + sassc (~> 2.0) foreman (0.87.0) formatador (0.2.5) - globalid (1.1.0) - activesupport (>= 5.0) + globalid (1.2.1) + activesupport (>= 6.1) guard (2.16.1) formatador (>= 0.2.4) listen (>= 2.7, < 4.0) @@ -214,9 +229,12 @@ GEM html-pipeline (2.12.3) activesupport (>= 2) nokogiri (>= 1.4) - i18n (1.12.0) + i18n (1.14.1) concurrent-ruby (~> 1.0) image_size (1.3.1) + importmap-rails (1.2.1) + actionpack (>= 6.0.0) + railties (>= 6.0.0) jbuilder (2.10.0) activesupport (>= 5.0.0) jquery-fileupload-rails (0.3.5) @@ -228,8 +246,6 @@ GEM rails-dom-testing (>= 1, < 3) railties (>= 4.2.0) thor (>= 0.14, < 2.0) - jquery-ui-rails (6.0.1) - railties (>= 3.2.16) json (2.3.0) kaminari (1.2.1) activesupport (>= 4.1.0) @@ -243,7 +259,6 @@ GEM activerecord kaminari-core (= 1.2.1) kaminari-core (1.2.1) - kgio (2.11.4) launchy (2.4.3) addressable (~> 2.3) letter_opener (1.7.0) @@ -253,13 +268,13 @@ GEM libv8-node (16.10.0.0-x86_64-darwin) libv8-node (16.10.0.0-x86_64-linux) liquid (5.0.1) - listen (3.4.1) + listen (3.8.0) rb-fsevent (~> 0.10, >= 0.10.3) rb-inotify (~> 0.9, >= 0.9.10) local_time (2.1.0) - loofah (2.20.0) + loofah (2.22.0) crass (~> 1.0.2) - nokogiri (>= 1.5.9) + nokogiri (>= 1.12.0) lumberjack (1.2.4) mail (2.8.1) mini_mime (>= 0.1.1) @@ -269,35 +284,35 @@ GEM marcel (1.0.2) matrix (0.4.2) method_source (0.9.2) - mini_mime (1.1.2) - mini_portile2 (2.8.1) + mini_mime (1.1.5) + mini_portile2 (2.8.5) mini_racer (0.6.2) libv8-node (~> 16.10.0.0) - minitest (5.18.0) + minitest (5.22.2) mono_logger (1.1.1) msgpack (1.5.2) multi_json (1.15.0) mustermann (2.0.2) ruby2_keywords (~> 0.0.1) nenv (0.3.0) - net-imap (0.3.4) + net-imap (0.4.10) date net-protocol net-pop (0.1.2) net-protocol - net-protocol (0.2.1) + net-protocol (0.2.2) timeout - net-smtp (0.3.3) + net-smtp (0.4.0.1) net-protocol - nio4r (2.5.8) - nokogiri (1.14.3) - mini_portile2 (~> 2.8.0) + nio4r (2.7.0) + nokogiri (1.16.2) + mini_portile2 (~> 2.8.2) racc (~> 1.4) - nokogiri (1.14.3-arm64-darwin) + nokogiri (1.16.2-arm64-darwin) racc (~> 1.4) - nokogiri (1.14.3-x86_64-darwin) + nokogiri (1.16.2-x86_64-darwin) racc (~> 1.4) - nokogiri (1.14.3-x86_64-linux) + nokogiri (1.16.2-x86_64-linux) racc (~> 1.4) notiffany (0.1.3) nenv (~> 0.1) @@ -311,38 +326,38 @@ GEM parslet (1.6.2) blankslate (>= 2.0, <= 4.0) pg (1.4.5) - popper_js (1.16.0) + popper_js (2.11.7) pry (0.12.2) coderay (~> 1.1.0) method_source (~> 0.9.0) - public_suffix (4.0.6) - puma (5.6.4) + public_suffix (5.0.3) + puma (6.4.2) nio4r (~> 2.0) - racc (1.6.2) - rack (2.2.6.4) + racc (1.7.3) + rack (2.2.8.1) rack-mini-profiler (2.3.0) rack (>= 1.2.0) rack-protection (2.2.3) rack rack-test (2.1.0) rack (>= 1.3) - rails (6.1.7.3) - actioncable (= 6.1.7.3) - actionmailbox (= 6.1.7.3) - actionmailer (= 6.1.7.3) - actionpack (= 6.1.7.3) - actiontext (= 6.1.7.3) - actionview (= 6.1.7.3) - activejob (= 6.1.7.3) - activemodel (= 6.1.7.3) - activerecord (= 6.1.7.3) - activestorage (= 6.1.7.3) - activesupport (= 6.1.7.3) + rails (7.0.8.1) + actioncable (= 7.0.8.1) + actionmailbox (= 7.0.8.1) + actionmailer (= 7.0.8.1) + actionpack (= 7.0.8.1) + actiontext (= 7.0.8.1) + actionview (= 7.0.8.1) + activejob (= 7.0.8.1) + activemodel (= 7.0.8.1) + activerecord (= 7.0.8.1) + activestorage (= 7.0.8.1) + activesupport (= 7.0.8.1) bundler (>= 1.15.0) - railties (= 6.1.7.3) - sprockets-rails (>= 2.0.0) - rails-dom-testing (2.0.3) - activesupport (>= 4.2.0) + railties (= 7.0.8.1) + rails-dom-testing (2.2.0) + activesupport (>= 5.0.0) + minitest nokogiri (>= 1.6) rails-html-sanitizer (1.4.4) loofah (~> 2.19, >= 2.19.1) @@ -350,16 +365,16 @@ GEM actionview (> 3.1) activesupport (> 3.1) railties (> 3.1) - railties (6.1.7.3) - actionpack (= 6.1.7.3) - activesupport (= 6.1.7.3) + railties (7.0.8.1) + actionpack (= 7.0.8.1) + activesupport (= 7.0.8.1) method_source rake (>= 12.2) thor (~> 1.0) + zeitwerk (~> 2.5) rainbow (3.1.1) - raindrops (0.20.0) - rake (13.0.6) - rb-fsevent (0.10.4) + rake (13.1.0) + rb-fsevent (0.11.2) rb-inotify (0.10.1) ffi (~> 1.0) record_tag_helper (1.0.1) @@ -367,7 +382,7 @@ GEM redis (4.7.0) redis-namespace (1.8.2) redis (>= 3.0.4) - regexp_parser (2.1.1) + regexp_parser (2.8.2) request_store (1.5.1) rack (>= 1.4) rerun (0.13.0) @@ -424,7 +439,7 @@ GEM ruby_audit (2.1.0) bundler-audit (~> 0.9.0) rubyzip (2.3.2) - sanitize (6.0.1) + sanitize (6.0.2) crass (~> 1.0.2) nokogiri (>= 1.12.0) sass-rails (6.0.0) @@ -437,22 +452,24 @@ GEM sprockets (> 3.0) sprockets-rails tilt - selenium-webdriver (3.142.7) - childprocess (>= 0.5, < 4.0) - rubyzip (>= 1.2.2) + selenium-webdriver (4.18.1) + base64 (~> 0.2) + rexml (~> 3.2, >= 3.2.5) + rubyzip (>= 1.2.2, < 3.0) + websocket (~> 1.0) shellany (0.0.1) shoulda-matchers (3.1.3) activesupport (>= 4.0.0) - simple_form (5.0.2) - actionpack (>= 5.0) - activemodel (>= 5.0) + simple_form (5.2.0) + actionpack (>= 5.2) + activemodel (>= 5.2) sinatra (2.2.3) mustermann (~> 2.0) rack (~> 2.2) rack-protection (= 2.2.3) tilt (~> 2.0) spring (2.1.1) - sprockets (4.2.0) + sprockets (4.2.1) concurrent-ruby (~> 1.0) rack (>= 2.2.4, < 4) sprockets-rails (3.4.2) @@ -460,23 +477,20 @@ GEM activesupport (>= 5.2) sprockets (>= 3.0.0) sqlite3 (1.4.2) - thor (1.2.1) + terser (1.1.15) + execjs (>= 0.3.0, < 3) + thor (1.2.2) tilt (2.0.11) time (0.2.2) date timecop (0.9.5) - timeout (0.3.2) + timeout (0.4.1) turbolinks (5.2.1) turbolinks-source (~> 5.2) turbolinks-source (5.2.0) tzinfo (2.0.6) concurrent-ruby (~> 1.0) - uglifier (4.2.0) - execjs (>= 0.3.0, < 3) unicode-display_width (2.3.0) - unicorn (6.1.0) - kgio (~> 2.6) - raindrops (~> 0.7) vegas (0.1.11) rack (>= 1.0.0) warden (1.2.8) @@ -486,18 +500,15 @@ GEM activemodel (>= 6.0.0) bindex (>= 0.4.0) railties (>= 6.0.0) - webdrivers (4.2.0) - nokogiri (~> 1.6) - rubyzip (>= 1.3.0) - selenium-webdriver (>= 3.0, < 4.0) - websocket-driver (0.7.5) + websocket (1.2.10) + websocket-driver (0.7.6) websocket-extensions (>= 0.1.0) websocket-extensions (0.1.5) whenever (1.0.0) chronic (>= 0.6.3) xpath (3.2.0) nokogiri (~> 1.8) - zeitwerk (2.6.7) + zeitwerk (2.6.13) PLATFORMS arm64-darwin @@ -510,70 +521,71 @@ DEPENDENCIES acts_as_tree (~> 2.9.1) bcrypt (= 3.1.12) bootsnap (>= 1.12.0) - bootstrap (~> 4.3.1) + bootstrap (~> 5.2.3) brakeman builder bundler-audit byebug cancancan (~> 1.10) - capybara (>= 3.26) + capybara (~> 3.39) coffee-rails (~> 5.0) database_cleaner differ (~> 0.1.2) - dradis-acunetix (~> 4.8.0) + dradis-acunetix (~> 4.11.0) dradis-api! - dradis-brakeman (~> 4.8.0) - dradis-burp (~> 4.8.0) - dradis-calculator_cvss (~> 4.8.0) - dradis-calculator_dread (~> 4.8.0) - dradis-coreimpact (~> 4.8.0) - dradis-csv (~> 4.8.0) - dradis-csv_export (~> 4.8.0) - dradis-html_export (~> 4.8.0) - dradis-metasploit (~> 4.8.0) - dradis-nessus (~> 4.8.0) - dradis-netsparker (~> 4.8.0) - dradis-nexpose (~> 4.8.0) - dradis-nikto (~> 4.8.0) - dradis-nipper (~> 4.8.0) - dradis-nmap (~> 4.8.0) - dradis-ntospider (~> 4.8.0) - dradis-openvas (~> 4.8.0) - dradis-plugins (~> 4.8.0) - dradis-projects (~> 4.8.0) - dradis-qualys (~> 4.8.0) - dradis-saint (~> 4.8.0) - dradis-veracode (~> 4.8.0) - dradis-wpscan (~> 4.8.0) - dradis-zap (~> 4.8.0) + dradis-brakeman (~> 4.11.0) + dradis-burp (~> 4.11.0) + dradis-calculator_cvss (~> 4.11.0) + dradis-calculator_dread (~> 4.11.0) + dradis-coreimpact (~> 4.11.0) + dradis-csv (~> 4.11.0) + dradis-csv_export (~> 4.11.0) + dradis-html_export (~> 4.11.0) + dradis-metasploit (~> 4.11.0) + dradis-nessus (~> 4.11.0) + dradis-netsparker (~> 4.11.0) + dradis-nexpose (~> 4.11.0) + dradis-nikto (~> 4.11.0) + dradis-nipper (~> 4.11.0) + dradis-nmap (~> 4.11.0) + dradis-ntospider (~> 4.11.0) + dradis-openvas (~> 4.11.0) + dradis-plugins! + dradis-projects (~> 4.11.0) + dradis-qualys (~> 4.11.0) + dradis-saint (~> 4.11.0) + dradis-veracode (~> 4.11.0) + dradis-wpscan (~> 4.11.0) + dradis-zap (~> 4.11.0) factory_bot_rails + font-awesome-sass (~> 6.4.0) foreman guard-rspec html-pipeline image_size (~> 1.3.0) + importmap-rails (~> 1.2) jbuilder (~> 2.7) jquery-fileupload-rails (~> 0.3.4) jquery-hotkeys-rails jquery-rails - jquery-ui-rails json (= 2.3.0) kaminari (~> 1.2.1) letter_opener liquid - listen (~> 3.3) + listen local_time (>= 2.0.0) matrix mini_racer net-imap net-pop net-smtp - nokogiri (>= 1.14.3) + nokogiri (>= 1.16.2) paper_trail (~> 12.2.0) parslet (~> 1.6.0) pg - puma (~> 5.0) + puma (>= 6.4.2) rack-mini-profiler (~> 2.0) - rails (~> 6.1.7.3) + rails (~> 7.0.8) rails-html-sanitizer (~> 1.4.4) record_tag_helper rerun @@ -584,23 +596,22 @@ DEPENDENCIES rubocop ruby_audit rubyzip (>= 1.2.2) - sanitize (= 6.0.1) + sanitize (= 6.0.2) sass-rails (~> 6.0) - selenium-webdriver + selenium-webdriver (~> 4.17) shoulda-matchers (~> 3.1) simple_form sinatra (~> 2.2.3) spring + sprockets-rails (>= 3.0.0) sqlite3 + terser (~> 1.1) thor (~> 1.2.1) time (>= 0.2.2) timecop turbolinks (~> 5) - uglifier (>= 1.3.0) - unicorn (= 6.1.0) warden (~> 1.2.3) web-console (>= 4.1.0) - webdrivers whenever RUBY VERSION diff --git a/README.md b/README.md index 03a914f25..9f42b205f 100644 --- a/README.md +++ b/README.md @@ -23,26 +23,20 @@ To try Dradis Community, you can deploy your own instance (you will need account * Platform independent * Markup support for the notes: text styles, code blocks, images, links, etc. * Integration with existing systems and tools: - * [Brakeman](https://dradisframework.com/ce/addons/brakeman.html) - * [Burp Suite](https://dradisframework.com/ce/addons/burp.html) - * [MediaWiki](https://dradisframework.com/ce/addons/mediawiki.html) - * [Metasploit](https://dradisframework.com/ce/addons/metasploit.html) - * [Nessus](https://dradisframework.com/ce/addons/nessus.html) - * [NeXpose](https://dradisframework.com/ce/addons/nexpose.html) - * [Nikto](https://dradisframework.com/ce/addons/nikto.html) - * [Nmap](https://dradisframework.com/ce/addons/nmap.html) - * [OpenVAS](https://dradisframework.com/ce/addons/openvas.html) - * [OSVDB](https://dradisframework.com/ce/addons/osvdb.html) - * [Qualys](https://dradisframework.com/ce/addons/qualys.html) - * [Retina](https://dradisframework.com/ce/addons/retina.html) - * [SAINT](https://dradisframework.com/ce/addons/saint.html) - * [SureCheck](https://dradisframework.com/ce/addons/surecheck.html) - * [VulnDB](https://dradisframework.com/ce/addons/vulndb.html) - * [w3af](https://dradisframework.com/ce/addons/w3af.html) - * [wXf](https://dradisframework.com/ce/addons/wxf.html) - * [Zed Attack Proxy](https://dradisframework.com/ce/addons/zap.html) + * [Brakeman](https://dradis.com/integrations/brakeman.html) + * [Burp Suite](https://dradis.com/integrations/burp.html) + * [MediaWiki](https://dradis.com/integrations/mediawiki.html) + * [Metasploit](https://dradis.com/integrations/metasploit.html) + * [Nessus](https://dradis.com/integrations/nessus.html) + * [NeXpose](https://dradis.com/integrations/nexpose.html) + * [Nikto](https://dradis.com/integrations/nikto.html) + * [Nmap](https://dradis.com/integrations/nmap.html) + * [OpenVAS](https://dradis.com/integrations/openvas.html) + * [Qualys](https://dradis.com/integrations/qualys.html) + * [SAINT](https://dradis.com/integrations/saint.html) + * [Zed Attack Proxy](https://dradis.com/integrations/zap.html) * ... - * [Full list](http://dradisframework.org/addons/) + * [Full list](http://dradis.org/integrations/) ## Editions @@ -50,44 +44,33 @@ To try Dradis Community, you can deploy your own instance (you will need account There are two editions of Dradis Framework: * **Dradis Framework Community Edition (CE)**: open-source and available freely under the GPLv2 license. -* **Dradis Framework Professional Edition (Pro)**: includes extra features that are more useful for organizations dealing with bigger teams and multiple projects at a time. To use Pro and get official support please [become a subscriber](https://dradisframework.com/pro/). +* **Dradis Framework Professional Edition (Pro)**: includes extra features that are more useful for organizations dealing with bigger teams and multiple projects at a time. To use Pro and get official support please [become a subscriber](https://dradis.com/). ## Getting started: Community Edition ### From Git (recommended) -[Installing Dradis from Git](https://dradisframework.com/ce/documentation/install_git.html) +[Installing Dradis from Git](https://dradis.com/ce/documentation/install_git.html) -### Using Vagrant +### Using Docker -If you'd like to use dradis in Vagrant, you can use the included Vagrantfile. +If you'd like to use Dradis in Docker, first get the latest image: ``` -# Clone the repo -git clone https://github.com/dradis/dradis-ce.git -cd dradis-ce/ - -# install/start the vagrant box -vagrant up -# ssh into the box -vagrant ssh - -# install ruby in the vagrant box -cd /dradis/dradis-ce -rvm install "$(cat .ruby-version)" +docker image pull dradis/dradis-ce:latest +``` +And then run the container: -# Then you can proceed with standard setup from within Vagrant -ruby bin/setup -# You'll need to tell the server to bind to 0.0.0.0 for port forwarding: -bundle exec rails server -b 0.0.0.0 +``` +docker run -it -p 3000:3000 dradis/dradis-ce ``` ## Getting help -* http://dradisframework.org/ +* https://dradis.com/support/ * [Community Forums](https://discuss.dradisframework.org/) * [Slack channel](https://evening-hamlet-4416.herokuapp.com/) * IRC: **#dradis** `irc.freenode.org` @@ -126,4 +109,4 @@ Dradis Framework Professional Edition is released under a commercial license. ## We're hiring -If you love open source, Ruby on Rails and would like to have a lot of freedom and autonomy in your work, maybe you should consider [joining our team](https://dradisframework.com/careers.html) to make Dradis even better. +If you love open source, Ruby on Rails and would like to have a lot of freedom and autonomy in your work, maybe you should consider [joining our team](https://dradis.com/careers.html) to make Dradis even better. diff --git a/Vagrantfile b/Vagrantfile deleted file mode 100644 index 131a8cd17..000000000 --- a/Vagrantfile +++ /dev/null @@ -1,88 +0,0 @@ -# -*- mode: ruby -*- -# vi: set ft=ruby : - -# All Vagrant configuration is done below. The '2' in Vagrant.configure -# configures the configuration version (we support older styles for -# backwards compatibility). Please don't change it unless you know what -# you're doing. -Vagrant.configure('2') do |config| - # The most common configuration options are documented and commented below. - # For a complete reference, please see the online documentation at - # https://docs.vagrantup.com. - - # Every Vagrant development environment requires a box. You can search for - # boxes at https://atlas.hashicorp.com/search. - config.vm.box = 'ubuntu/xenial64' - - # Disable automatic box update checking. If you disable this, then - # boxes will only be checked for updates when the user runs - # `vagrant box outdated`. This is not recommended. - # config.vm.box_check_update = false - - # Create a forwarded port mapping which allows access to a specific port - # within the machine from a port on the host machine. In the example below, - # accessing 'localhost:8080' will access port 80 on the guest machine. - config.vm.network 'forwarded_port', guest: 3000, host: 3000 - - # Create a private network, which allows host-only access to the machine - # using a specific IP. - # config.vm.network 'private_network', ip: '192.168.33.10' - - # Create a public network, which generally matched to bridged network. - # Bridged networks make the machine appear as another physical device on - # your network. - # config.vm.network 'public_network' - - # Share an additional folder to the guest VM. The first argument is - # the path on the host to the actual folder. The second argument is - # the path on the guest to mount the folder. And the optional third - # argument is a set of non-required options. - config.vm.synced_folder '..', '/dradis', create: true - - # Provider-specific configuration so you can fine-tune various - # backing providers for Vagrant. These expose provider-specific options. - # Example for VirtualBox: - # - config.vm.provider 'virtualbox' do |vb| - # # Display the VirtualBox GUI when booting the machine - # vb.gui = true - # - # Customize the amount of memory on the VM: - vb.memory = 4096 - vb.cpus = 2 - end - # - # View the documentation for the provider you are using for more - # information on available options. - - # Define a Vagrant Push strategy for pushing to Atlas. Other push strategies - # such as FTP and Heroku are also available. See the documentation at - # https://docs.vagrantup.com/v2/push/atlas.html for more information. - # config.push.define 'atlas' do |push| - # push.app = 'YOUR_ATLAS_USERNAME/YOUR_APPLICATION_NAME' - # end - - # Enable provisioning with a shell script. Additional provisioners such as - # Puppet, Chef, Ansible, Salt, and Docker are also available. Please see the - # documentation for more information about their specific syntax and use. - config.vm.provision 'shell', inline: <<-SHELL - apt-get update - DEBIAN_FRONTEND=noninteractive apt-get install -y \ - mysql-server \ - mysql-client \ - libmysqlclient-dev \ - libfontconfig \ - libfontconfig-dev - which phantomjs >/dev/null || ( cd /tmp && \ - wget -nv https://bitbucket.org/ariya/phantomjs/downloads/phantomjs-2.1.1-linux-x86_64.tar.bz2 && \ - echo '86dd9a4bf4aee45f1a84c9f61cf1947c1d6dce9b9e8d2a907105da7852460d2f phantomjs-2.1.1-linux-x86_64.tar.bz2' > phantomjs-2.1.1-linux-x86_64.tar.bz2.sha256 && \ - sha256sum -c phantomjs-2.1.1-linux-x86_64.tar.bz2.sha256 - bzip2 -d phantomjs-2.1.1-linux-x86_64.tar.bz2 && \ - tar -xf phantomjs-2.1.1-linux-x86_64.tar && \ - cp phantomjs-2.1.1-linux-x86_64/bin/phantomjs /usr/bin/phantomjs && \ - rm -rf ./phantomjs-2.1.1-linux-x86_64.* - ) - su ubuntu -c 'type rvm >/dev/null 2>&1 || (( gpg --keyserver hkp://keys.gnupg.net --recv-keys 409B6B1796C275462A1703113804BB82D39DC0E3 ) && ( curl -sSL https://get.rvm.io | bash -s stable ))' - su ubuntu -c 'cd /dradis/dradis-ce/ && source "$HOME/.profile" && rvm install "$(cat .ruby-version)"' - SHELL -end diff --git a/app/assets/config/manifest.js b/app/assets/config/manifest.js index b16e53d6d..bdfe922d3 100644 --- a/app/assets/config/manifest.js +++ b/app/assets/config/manifest.js @@ -1,3 +1,13 @@ +//= link application.css +//= link setup/setup.css +//= link tylium.css + +//= link legacy.application.js +//= link tylium.js + +//= link_tree ../../javascript .js +//= link_tree ../../../vendor/javascript .js + //= link_tree ../images -//= link_directory ../javascripts .js -//= link_directory ../stylesheets .css + +//= link_tree ../../../vendor/assets diff --git a/app/assets/javascripts/application.js b/app/assets/javascripts/legacy.application.js similarity index 100% rename from app/assets/javascripts/application.js rename to app/assets/javascripts/legacy.application.js diff --git a/app/assets/javascripts/shared/behaviors.js b/app/assets/javascripts/shared/behaviors.js index ab57699e8..cd6ac4f75 100644 --- a/app/assets/javascripts/shared/behaviors.js +++ b/app/assets/javascripts/shared/behaviors.js @@ -1,73 +1,94 @@ -(function($, window){ +(function ($, window) { function initBehaviors(parentElement) { // Activate jQuery.Textile $(parentElement).find('.textile').textile(); // Activate DataTables - $(parentElement).find('[data-behavior~=dradis-datatable]').each(function() { - new DradisDatatable(this); - }); + $(parentElement) + .find('[data-behavior~=dradis-datatable]') + .each(function () { + new DradisDatatable(this); + }); // Activate Rich Toolbars for the editor - $(parentElement).find('[data-behavior~=rich-toolbar]').each(function() { - new EditorToolbar($(this)); + $(parentElement) + .find('[data-behavior~=rich-toolbar]') + .each(function () { + new EditorToolbar($(this)); - // Activate QuoteSelector after Rich toolbars - // This can be globally scoped because the QuoteSelector does not allow - // double binding - $('[data-behavior~=content-textile]').each(function() { - new QuoteSelector(this); + // Activate QuoteSelector after Rich toolbars + // This can be globally scoped because the QuoteSelector does not allow + // double binding + $('[data-behavior~=content-textile]').each(function () { + new QuoteSelector(this); + }); }); - }); // Activate local auto save - $(parentElement).find('[data-behavior~=local-auto-save]').each(function() { - new LocalAutoSave(this); - }); + $(parentElement) + .find('[data-behavior~=local-auto-save]') + .each(function () { + new LocalAutoSave(this); + }); // Fetch content - $(parentElement).find('[data-behavior~=fetch]').each(function() { - var that = this; - $.ajax(that.dataset.path, { credentials: 'include' }) - .then(function(response) { return response; }) - .then(function(html) { - $(that).html(html); - $(that).trigger('dradis:fetch'); - initBehaviors(that); - }); - }); + $(parentElement) + .find('[data-behavior~=fetch]') + .each(function () { + var that = this; + $.ajax(that.dataset.path, { credentials: 'include' }) + .then(function (response) { + return response; + }) + .then(function (html) { + $(that).html(html); + $(that).trigger('dradis:fetch'); + initBehaviors(that); + }); + }); // Allow page anchors to work - $(parentElement).find('[data-behavior~=deeplinks] >* a').click(function (e) { - history.pushState(null, null, $(e.target).attr('href')); - }); + $(parentElement) + .find('[data-behavior~=deeplinks] >* a') + .click(function (e) { + history.pushState(null, null, $(e.target).attr('href')); + }); // Show the pane for a given anchor - $(parentElement).find('[data-behavior~=deeplinks] >* a').each(function() { - if (window.location.hash == $(this).attr('href')) { - $(this).tab('show'); - } - }); + $(parentElement) + .find('[data-behavior~=deeplinks] >* a') + .each(function () { + if (window.location.hash == $(this).attr('href')) { + $(this).tab('show'); + } + }); - // Init Bootstrap tooltips - $('[data-toggle~=tooltip]').tooltip(); + // Init Bootstrap tooltips with 1ms delay for tooltips within diff --git a/app/views/boards/_actions.html.erb b/app/views/boards/_actions.html.erb index 520209ba3..2d7300012 100644 --- a/app/views/boards/_actions.html.erb +++ b/app/views/boards/_actions.html.erb @@ -3,17 +3,17 @@ <%= link_to( "#modal-board-edit-#{@board.id}", - data: { behavior: 'board-modal' }, + data: { bs_toggle: 'modal' }, tabindex: -1 ) do %> - Edit - <% end %> - - diff --git a/app/views/boards/_board.html.erb b/app/views/boards/_board.html.erb index c0d225ee0..d8672cb5b 100644 --- a/app/views/boards/_board.html.erb +++ b/app/views/boards/_board.html.erb @@ -4,21 +4,21 @@ <% board.ordered_lists.each do |list| %> <% cache ['board-list', list] do %> -
  • -
    -

    - <%= list.name %> - <%= list.cards.count %> -

    +
  • +
    +

    + <%= list.name %> + <%= list.cards.count %> +

    -
    - <%= +
    + <%= link_to( "#modal-list-edit-#{list.id}", - class: 'js-list-modal' + data: { bs_toggle: 'modal' } ) do %> - Edit + Edit <% end %> <%= link_to( @@ -27,7 +27,7 @@ data: { confirm: "Are you sure?\n\nProceeding will delete this list from the methodology, along with any associated tasks." }, method: 'delete' ) do %> - Delete + Delete <% end %>
    @@ -35,45 +35,45 @@
      <% list.ordered_cards.each do |card| %> <% cache ['board-list-card', card] do %> -
    • - <%= link_to project_board_list_card_path(current_project, board, list, card) do %> -
      -
      <%= card.name %>
      -
      - <% if card.due_date %> - <% case (card.due_date - Date.today).to_i %> - <% when -Float::INFINITY..-1 %> -
      - <% when 0 %> -
      - <% else %> -
      - <% end %> - - <%= card.due_date.strftime('%b %-d') %> +
    • + <%= link_to project_board_list_card_path(current_project, board, list, card) do %> +
      +
      <%= card.name %>
      +
      + <% if card.due_date %> + <% case (card.due_date - Date.today).to_i %> + <% when -Float::INFINITY..-1 %> +
      + <% when 0 %> +
      + <% else %> +
      + <% end %> + + <%= card.due_date.strftime('%b %-d') %> +
      + <% end %> +
      +
      + <% card.assignees.each do |user| %> + <%= avatar_image(user, size: 30) %> + <% end %>
      - <% end %> -
      -
      - <% card.assignees.each do |user| %> - <%= avatar_image(user, size: 30) %> - <% end %> -
      -
      - <% end %> -
    • - <% end %> <%# board-list-card cache %> - <% end %> -
    - <%= link_to 'Add a task...', new_project_board_list_card_path(current_project, board, list), class: 'card-new' %> -
  • + + <% end %> + + <% end %> <%# board-list-card cache %> + <% end %> + + <%= link_to 'Add a task...', new_project_board_list_card_path(current_project, board, list), class: 'card-new' %> + <% end %> <%# board-list cache %> <% end %>
  • Add a list... @@ -83,7 +83,7 @@ <%= render 'shared/empty_state', actions_partial: 'boards/board/empty_state_actions', name: 'list', - docs_link: 'https://dradisframework.com/support/guides/projects/methodologies.html#list', + docs_link: 'https://dradis.com/support/guides/projects/methodologies.html#list', text: 'Use lists to organize tasks in the methodology board.' %> <% end %> diff --git a/app/views/boards/_empty_state_actions.html.erb b/app/views/boards/_empty_state_actions.html.erb index beaa6c2b3..55e157661 100644 --- a/app/views/boards/_empty_state_actions.html.erb +++ b/app/views/boards/_empty_state_actions.html.erb @@ -5,17 +5,17 @@
    - <%= link_to '#modal-board-new', class: 'btn btn-primary btn-lg mb-2 px-5', data: { behavior: 'board-modal', toggle: 'modal' } do %> - Add Methodology + <%= link_to '#modal-board-new', class: 'btn btn-primary btn-lg mb-2 px-5', data: { bs_toggle: 'modal' } do %> + Add Methodology <% end %>

    Get started quickly by using templates that have been created by us or the Dradis Community:

    You can also find more tamplates in our portal: diff --git a/app/views/boards/board/_empty_state_actions.html.erb b/app/views/boards/board/_empty_state_actions.html.erb index 458aaac25..f7b3dfb8e 100644 --- a/app/views/boards/board/_empty_state_actions.html.erb +++ b/app/views/boards/board/_empty_state_actions.html.erb @@ -1,6 +1,6 @@

    Lists can represent task categories (e.g. External, Internal, Webapp, etc.), task statuses (e.g. Next, In Progress, Ready for Review, Completed), or they can be labeled in any way that makes the most sense for your team's workflow.

    - <%= link_to '#modal-list-new', class: 'btn btn-primary btn-lg mb-2 px-5 js-list-modal' do %> - Add List + <%= link_to '#modal-list-new', class: 'btn btn-primary btn-lg mb-2 px-5', data: { bs_toggle: 'modal' } do %> + Add List <% end %>
    diff --git a/app/views/boards/index.html.erb b/app/views/boards/index.html.erb index 1fe1e0fa4..542d5e235 100644 --- a/app/views/boards/index.html.erb +++ b/app/views/boards/index.html.erb @@ -18,34 +18,18 @@ <% end %>
    - <%= - link_to( - "#modal-board-edit-#{board.id}", - data: { behavior: 'board-modal' } - ) do - %> - Edit + <%= link_to("#modal-board-edit-#{board.id}", data: { bs_toggle: 'modal' }) do %> + Edit <% end %> - <%= - link_to( - [current_project, board], - class: 'text-error-hover', - data: { confirm: "Are you sure?\n\nProceeding will delete this methodology from the project, as well as with any associated lists and tasks." }, - method: 'delete' - ) do %> - Delete + <%= link_to([current_project, board], class: 'text-error-hover', data: { confirm: "Are you sure?\n\nProceeding will delete this methodology from the project, as well as with any associated lists and tasks." }, method: 'delete') do %> + Delete <% end %>
  • <% end %>
  • - + Create new methodology...
  • @@ -53,7 +37,7 @@ <% else %> <%= render 'shared/empty_state', actions_partial: 'boards/empty_state_actions', - docs_link: 'https://dradisframework.com/support/guides/projects/methodologies.html', + docs_link: 'https://dradis.com/support/guides/projects/methodologies.html', name: 'methodology', text: 'Drive consistency and quality by using a standard methodology for each assessment type.' %> diff --git a/app/views/boards/modals/_board_rename_form.html.erb b/app/views/boards/modals/_board_rename_form.html.erb index 5bf046a4f..339f5617b 100644 --- a/app/views/boards/modals/_board_rename_form.html.erb +++ b/app/views/boards/modals/_board_rename_form.html.erb @@ -11,8 +11,8 @@ <%= simple_form_for [current_project, board] do |f| %> @@ -23,7 +23,7 @@ <% end %> diff --git a/app/views/boards/modals/_list_rename_form.html.erb b/app/views/boards/modals/_list_rename_form.html.erb index 837b7297c..45d4af4e4 100644 --- a/app/views/boards/modals/_list_rename_form.html.erb +++ b/app/views/boards/modals/_list_rename_form.html.erb @@ -11,8 +11,8 @@ <%= simple_form_for [current_project, board, list] do |f| %> <% end %> diff --git a/app/views/boards/modals/_new_board_form.html.erb b/app/views/boards/modals/_new_board_form.html.erb index c79b06be8..500a2797b 100644 --- a/app/views/boards/modals/_new_board_form.html.erb +++ b/app/views/boards/modals/_new_board_form.html.erb @@ -15,25 +15,25 @@