- <%= link_to t('all'), url_for(params.to_unsafe_h.except(:status)), style: 'margin-bottom: -1px', class: "tab h-10 text-base #{params[:status].blank? ? 'tab-active tab-bordered' : 'pb-[3px]'}" %>
- <%= link_to t('succeeded'), url_for(params.to_unsafe_h.merge(status: 'success')), style: 'margin-bottom: -1px', class: "tab h-10 text-base #{params[:status] == 'success' ? 'tab-active tab-bordered' : 'pb-[3px]'}" %>
- <%= link_to t('failed'), url_for(params.to_unsafe_h.merge(status: 'error')), style: 'margin-bottom: -1px', class: "tab h-10 text-base #{params[:status] == 'error' ? 'tab-active tab-bordered' : 'pb-[3px]'}" %>
+ <%= link_to t('all'), url_for(params: request.query_parameters.except('status')), style: 'margin-bottom: -1px', class: "tab h-10 text-base #{params[:status].blank? ? 'tab-active tab-bordered' : 'pb-[3px]'}" %>
+ <%= link_to t('succeeded'), url_for(params: request.query_parameters.merge('status' => 'success')), style: 'margin-bottom: -1px', class: "tab h-10 text-base #{params[:status] == 'success' ? 'tab-active tab-bordered' : 'pb-[3px]'}" %>
+ <%= link_to t('failed'), url_for(params: request.query_parameters.merge('status' => 'error')), style: 'margin-bottom: -1px', class: "tab h-10 text-base #{params[:status] == 'error' ? 'tab-active tab-bordered' : 'pb-[3px]'}" %>
diff --git a/config/routes.rb b/config/routes.rb
index 4447a239..2703f136 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -56,7 +56,7 @@ Rails.application.routes.draw do
resources :account_custom_fields, only: %i[create]
resources :user_configs, only: %i[create]
resources :encrypted_user_configs, only: %i[destroy]
- resources :timestamp_server, only: %i[create]
+ resources :timestamp_server, only: %i[create] unless Docuseal.multitenant?
resources :dashboard, only: %i[index]
resources :setup, only: %i[index create]
resource :newsletter, only: %i[show update]
diff --git a/lib/download_utils.rb b/lib/download_utils.rb
index dce5427a..8b352502 100644
--- a/lib/download_utils.rb
+++ b/lib/download_utils.rb
@@ -35,16 +35,16 @@ module DownloadUtils
module_function
- def call(url)
+ def call(url, validate: Docuseal.multitenant?)
uri = begin
URI(url)
rescue URI::Error
Addressable::URI.parse(url).normalize
end
- validate_uri!(uri) if Docuseal.multitenant?
+ validate_uri!(uri) if validate
- resp = conn.get(uri)
+ resp = conn(validate:).get(uri)
raise UnableToDownload, "Error loading: #{uri}" if resp.status >= 400
@@ -52,14 +52,15 @@ module DownloadUtils
end
def validate_uri!(uri)
- raise UnableToDownload, "Error loading: #{uri}. Only HTTPS is allowed." if uri.scheme != 'https'
+ raise UnableToDownload, "Error loading: #{uri}. Only HTTPS is allowed." if uri.scheme != 'https' ||
+ [443, nil].exclude?(uri.port)
raise UnableToDownload, "Error loading: #{uri}. Can't download from localhost." if uri.host.in?(LOCALHOSTS)
end
- def conn
+ def conn(validate: Docuseal.multitenant?)
Faraday.new do |faraday|
faraday.response :follow_redirects, callback: lambda { |_, new_env|
- validate_uri!(new_env[:url]) if Docuseal.multitenant?
+ validate_uri!(new_env[:url]) if validate
}
end
end
diff --git a/lib/send_webhook_request.rb b/lib/send_webhook_request.rb
index a3474eaf..87de376a 100644
--- a/lib/send_webhook_request.rb
+++ b/lib/send_webhook_request.rb
@@ -22,7 +22,7 @@ module SendWebhookRequest
end
if Docuseal.multitenant?
- raise HttpsError, 'Only HTTPS is allowed.' if uri.scheme != 'https' &&
+ raise HttpsError, 'Only HTTPS is allowed.' if (uri.scheme != 'https' || [443, nil].exclude?(uri.port)) &&
!AccountConfig.exists?(key: :allow_http,
account_id: webhook_url.account_id)
raise LocalhostError, "Can't send to localhost." if uri.host.in?(LOCALHOSTS)
diff --git a/lib/submissions.rb b/lib/submissions.rb
index aaf18ea4..8fd26bf0 100644
--- a/lib/submissions.rb
+++ b/lib/submissions.rb
@@ -18,7 +18,8 @@ module Submissions
def plain_search(submissions, keyword, search_values: false, search_template: false)
return submissions if keyword.blank?
- term = "%#{keyword.downcase}%"
+ sanitized = ActiveRecord::Base.sanitize_sql_like(keyword.downcase)
+ term = "%#{sanitized}%"
arel_table = Submitter.arel_table
@@ -31,7 +32,7 @@ module Submissions
if search_template
submissions = submissions.left_joins(:template)
- arel = arel.or(Template.arel_table[:name].lower.matches("%#{keyword.downcase}%"))
+ arel = arel.or(Template.arel_table[:name].lower.matches("%#{sanitized}%"))
end
submissions.joins(:submitters).where(arel).group(:id)
diff --git a/lib/submissions/generate_result_attachments.rb b/lib/submissions/generate_result_attachments.rb
index 72eeb9f1..580b9be1 100644
--- a/lib/submissions/generate_result_attachments.rb
+++ b/lib/submissions/generate_result_attachments.rb
@@ -162,7 +162,7 @@ module Submissions
pdf.trailer.info[:DocumentID] = document_id
pdf.pages.each do |page|
- font_size = (([page.box.width, page.box.height].min / A4_SIZE[0].to_f) * 9).to_i
+ font_size = [(([page.box.width, page.box.height].min / A4_SIZE[0].to_f) * 9).to_i, 4].max
cnv = page.canvas(type: :overlay)
text =
diff --git a/lib/submitters.rb b/lib/submitters.rb
index c557dd3e..47fbf014 100644
--- a/lib/submitters.rb
+++ b/lib/submitters.rb
@@ -14,6 +14,7 @@ module Submitters
UnableToSendCode = Class.new(StandardError)
InvalidOtp = Class.new(StandardError)
MaliciousFileExtension = Class.new(StandardError)
+ ArgumentError = Class.new(StandardError)
DANGEROUS_EXTENSIONS = Set.new(%w[
exe com bat cmd scr pif vbs vbe js jse wsf wsh msi msp
@@ -133,7 +134,7 @@ module Submitters
filename: file.original_filename,
content_type: file.content_type)
else
- ActiveStorage::Blob.find_signed(params[:blob_signed_id])
+ raise ArgumentError, 'file param is missing'
end
ActiveStorage::Attachment.create!(
diff --git a/lib/submitters/authorized_for_form.rb b/lib/submitters/authorized_for_form.rb
new file mode 100644
index 00000000..81048a16
--- /dev/null
+++ b/lib/submitters/authorized_for_form.rb
@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module Submitters
+ module AuthorizedForForm
+ Unauthorized = Class.new(StandardError)
+
+ module_function
+
+ def call(submitter, current_user, request)
+ pass_email_2fa?(submitter, request) && pass_link_2fa?(submitter, current_user, request)
+ end
+
+ def pass_email_2fa?(submitter, request)
+ return false unless submitter
+
+ return true if submitter.submission.template&.preferences&.dig('require_email_2fa') != true &&
+ submitter.preferences['require_email_2fa'] != true
+ return true if request.cookie_jar.encrypted[:email_2fa_slug] == submitter.slug
+
+ token = request.params[:two_factor_token].presence || request.headers['x-two-factor-token'].presence
+
+ return true if token.present? &&
+ Submitter.signed_id_verifier.verified(token, purpose: :email_two_factor) == submitter.slug
+
+ false
+ end
+
+ def pass_link_2fa?(submitter, current_user, request)
+ return false unless submitter
+
+ return true if submitter.submission.source != 'link'
+ return true unless submitter.submission.template&.preferences&.dig('shared_link_2fa') == true
+ return true if request.cookie_jar.encrypted[:email_2fa_slug] == submitter.slug
+ return true if submitter.email == current_user&.email && current_user&.account_id == submitter.account_id
+
+ if (token = request.params[:two_factor_token].presence || request.headers['x-two-factor-token'].presence)
+ link_2fa_key = [submitter.email.downcase.squish, submitter.submission.template.slug].join(':')
+
+ return true if Submitter.signed_id_verifier.verified(token, purpose: :email_two_factor) == link_2fa_key
+ end
+
+ false
+ end
+ end
+end
diff --git a/lib/submitters/normalize_values.rb b/lib/submitters/normalize_values.rb
index 16cb268c..1eee3dfd 100644
--- a/lib/submitters/normalize_values.rb
+++ b/lib/submitters/normalize_values.rb
@@ -236,7 +236,7 @@ module Submitters
return blob if blob
- data = DownloadUtils.call(url).body
+ data = DownloadUtils.call(url, validate: true).body
checksum = Digest::MD5.base64digest(data)
diff --git a/lib/template_folders.rb b/lib/template_folders.rb
index 00a6fc02..d4a3af9e 100644
--- a/lib/template_folders.rb
+++ b/lib/template_folders.rb
@@ -20,7 +20,9 @@ module TemplateFolders
def search(folders, keyword)
return folders if keyword.blank?
- folders.where(TemplateFolder.arel_table[:name].lower.matches("%#{keyword.downcase}%"))
+ sanitized = ActiveRecord::Base.sanitize_sql_like(keyword.downcase)
+
+ folders.where(TemplateFolder.arel_table[:name].lower.matches("%#{sanitized}%"))
end
def filter_active_folders(template_folders, templates)
diff --git a/lib/templates.rb b/lib/templates.rb
index 73aaef80..2abd93dd 100644
--- a/lib/templates.rb
+++ b/lib/templates.rb
@@ -52,7 +52,9 @@ module Templates
def plain_search(templates, keyword)
return templates if keyword.blank?
- templates.where(Template.arel_table[:name].lower.matches("%#{keyword.downcase}%"))
+ sanitized = ActiveRecord::Base.sanitize_sql_like(keyword.downcase)
+
+ templates.where(Template.arel_table[:name].lower.matches("%#{sanitized}%"))
end
def fulltext_search(current_user, templates, keyword)
diff --git a/public/apple-icon-180x180.png b/public/apple-icon-180x180.png
index 54ae5fcf..08c0c3b8 100644
Binary files a/public/apple-icon-180x180.png and b/public/apple-icon-180x180.png differ
diff --git a/public/apple-touch-icon-precomposed.png b/public/apple-touch-icon-precomposed.png
index d6a6d23c..67113d91 100644
Binary files a/public/apple-touch-icon-precomposed.png and b/public/apple-touch-icon-precomposed.png differ
diff --git a/public/apple-touch-icon.png b/public/apple-touch-icon.png
index d6a6d23c..67113d91 100644
Binary files a/public/apple-touch-icon.png and b/public/apple-touch-icon.png differ
diff --git a/public/favicon-16x16.png b/public/favicon-16x16.png
index 45a2768f..e38921b8 100644
Binary files a/public/favicon-16x16.png and b/public/favicon-16x16.png differ
diff --git a/public/favicon-32x32.png b/public/favicon-32x32.png
index 01e7fada..fd8ea8dd 100644
Binary files a/public/favicon-32x32.png and b/public/favicon-32x32.png differ
diff --git a/public/favicon-96x96.png b/public/favicon-96x96.png
index a1eee746..600a59f4 100644
Binary files a/public/favicon-96x96.png and b/public/favicon-96x96.png differ
diff --git a/public/favicon.ico b/public/favicon.ico
index cb036abd..c0c2bf89 100644
Binary files a/public/favicon.ico and b/public/favicon.ico differ
diff --git a/public/favicon.svg b/public/favicon.svg
new file mode 100644
index 00000000..ebfb3040
--- /dev/null
+++ b/public/favicon.svg
@@ -0,0 +1,5 @@
+
diff --git a/spec/jobs/send_form_completed_webhook_request_job_spec.rb b/spec/jobs/send_form_completed_webhook_request_job_spec.rb
index b60a3d9b..6eb7cdf8 100644
--- a/spec/jobs/send_form_completed_webhook_request_job_spec.rb
+++ b/spec/jobs/send_form_completed_webhook_request_job_spec.rb
@@ -16,6 +16,10 @@ RSpec.describe SendFormCompletedWebhookRequestJob do
end
describe '#perform' do
+ around do |example|
+ freeze_time { example.run }
+ end
+
before do
stub_request(:post, webhook_url.url).to_return(status: 200)
end
diff --git a/spec/jobs/send_form_declined_webhook_request_job_spec.rb b/spec/jobs/send_form_declined_webhook_request_job_spec.rb
index 8e9d2d0d..99f26eef 100644
--- a/spec/jobs/send_form_declined_webhook_request_job_spec.rb
+++ b/spec/jobs/send_form_declined_webhook_request_job_spec.rb
@@ -16,6 +16,10 @@ RSpec.describe SendFormDeclinedWebhookRequestJob do
end
describe '#perform' do
+ around do |example|
+ freeze_time { example.run }
+ end
+
before do
stub_request(:post, webhook_url.url).to_return(status: 200)
end
diff --git a/spec/jobs/send_form_started_webhook_request_job_spec.rb b/spec/jobs/send_form_started_webhook_request_job_spec.rb
index e09f4205..54a5c521 100644
--- a/spec/jobs/send_form_started_webhook_request_job_spec.rb
+++ b/spec/jobs/send_form_started_webhook_request_job_spec.rb
@@ -16,6 +16,10 @@ RSpec.describe SendFormStartedWebhookRequestJob do
end
describe '#perform' do
+ around do |example|
+ freeze_time { example.run }
+ end
+
before do
stub_request(:post, webhook_url.url).to_return(status: 200)
end
diff --git a/spec/jobs/send_form_viewed_webhook_request_job_spec.rb b/spec/jobs/send_form_viewed_webhook_request_job_spec.rb
index 31026341..5cbed3c3 100644
--- a/spec/jobs/send_form_viewed_webhook_request_job_spec.rb
+++ b/spec/jobs/send_form_viewed_webhook_request_job_spec.rb
@@ -16,6 +16,10 @@ RSpec.describe SendFormViewedWebhookRequestJob do
end
describe '#perform' do
+ around do |example|
+ freeze_time { example.run }
+ end
+
before do
stub_request(:post, webhook_url.url).to_return(status: 200)
end
diff --git a/spec/jobs/send_submission_completed_webhook_request_job_spec.rb b/spec/jobs/send_submission_completed_webhook_request_job_spec.rb
index 97ec0b69..72764b04 100644
--- a/spec/jobs/send_submission_completed_webhook_request_job_spec.rb
+++ b/spec/jobs/send_submission_completed_webhook_request_job_spec.rb
@@ -13,6 +13,10 @@ RSpec.describe SendSubmissionCompletedWebhookRequestJob do
end
describe '#perform' do
+ around do |example|
+ freeze_time { example.run }
+ end
+
before do
stub_request(:post, webhook_url.url).to_return(status: 200)
end
diff --git a/spec/jobs/send_submission_created_webhook_request_job_spec.rb b/spec/jobs/send_submission_created_webhook_request_job_spec.rb
index e80b97a6..62a1d432 100644
--- a/spec/jobs/send_submission_created_webhook_request_job_spec.rb
+++ b/spec/jobs/send_submission_created_webhook_request_job_spec.rb
@@ -13,6 +13,10 @@ RSpec.describe SendSubmissionCreatedWebhookRequestJob do
end
describe '#perform' do
+ around do |example|
+ freeze_time { example.run }
+ end
+
before do
stub_request(:post, webhook_url.url).to_return(status: 200)
end
diff --git a/spec/jobs/send_submission_expired_webhook_request_job_spec.rb b/spec/jobs/send_submission_expired_webhook_request_job_spec.rb
index dbce55ba..541eb73b 100644
--- a/spec/jobs/send_submission_expired_webhook_request_job_spec.rb
+++ b/spec/jobs/send_submission_expired_webhook_request_job_spec.rb
@@ -13,6 +13,10 @@ RSpec.describe SendSubmissionExpiredWebhookRequestJob do
end
describe '#perform' do
+ around do |example|
+ freeze_time { example.run }
+ end
+
before do
stub_request(:post, webhook_url.url).to_return(status: 200)
end
diff --git a/spec/jobs/send_template_created_webhook_request_job_spec.rb b/spec/jobs/send_template_created_webhook_request_job_spec.rb
index e5ce6f10..696d47d4 100644
--- a/spec/jobs/send_template_created_webhook_request_job_spec.rb
+++ b/spec/jobs/send_template_created_webhook_request_job_spec.rb
@@ -12,6 +12,10 @@ RSpec.describe SendTemplateCreatedWebhookRequestJob do
end
describe '#perform' do
+ around do |example|
+ freeze_time { example.run }
+ end
+
before do
stub_request(:post, webhook_url.url).to_return(status: 200)
end
diff --git a/spec/jobs/send_template_updated_webhook_request_job_spec.rb b/spec/jobs/send_template_updated_webhook_request_job_spec.rb
index f13675a1..c0ecec8b 100644
--- a/spec/jobs/send_template_updated_webhook_request_job_spec.rb
+++ b/spec/jobs/send_template_updated_webhook_request_job_spec.rb
@@ -12,6 +12,10 @@ RSpec.describe SendTemplateUpdatedWebhookRequestJob do
end
describe '#perform' do
+ around do |example|
+ freeze_time { example.run }
+ end
+
before do
stub_request(:post, webhook_url.url).to_return(status: 200)
end
diff --git a/spec/rails_helper.rb b/spec/rails_helper.rb
index db91da56..ecca6019 100644
--- a/spec/rails_helper.rb
+++ b/spec/rails_helper.rb
@@ -54,6 +54,7 @@ RSpec.configure do |config|
config.include FactoryBot::Syntax::Methods
config.include Devise::Test::IntegrationHelpers
config.include SigningFormHelper
+ config.include ActiveSupport::Testing::TimeHelpers
config.before(:each, type: :system) do
if ENV['HEADLESS'] == 'false'
diff --git a/spec/system/email_settings_spec.rb b/spec/system/email_settings_spec.rb
index f7d683b8..fe842a1d 100644
--- a/spec/system/email_settings_spec.rb
+++ b/spec/system/email_settings_spec.rb
@@ -61,7 +61,6 @@ RSpec.describe 'Email Settings' do
expect(page).to have_field('Host', with: encrypted_config.value['host'])
expect(page).to have_field('Port', with: encrypted_config.value['port'])
expect(page).to have_field('Username', with: encrypted_config.value['username'])
- expect(page).to have_field('Password', with: encrypted_config.value['password'])
expect(page).to have_field('Domain', with: encrypted_config.value['domain'])
expect(page).to have_select('Authentication', selected: 'Plain')
expect(page).to have_field('Send from Email', with: encrypted_config.value['from_email'])