Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Push v24.1.5 bug fixes into v25.0.x release branch #8909

Merged
merged 12 commits into from
Oct 3, 2023

Conversation

driusan
Copy link
Collaborator

@driusan driusan commented Oct 3, 2023

Push bug fixes forward.

DO NOT SQUASH.

xlecours and others added 12 commits July 4, 2023 15:52
Add accessibility check for candidate metadata, not just visits.
This was made to remove overrides on COPN and CBIGR

- removes notices
- removes deprecation warning
- add filter options to filter with limited set of options
Checkbox elements can not be defined as required like the rest of the elements. This add support for required.

A required checkbox must be checked for the form to be submitted. (ie. for questions like "Have you read the terms of service?")
In the feedback panel for an instrument, the only option in 'Field Name' was 'Across all fields'. This changes how the field names for an instrument are fetched so that all of them appear as an option too.
- Fix date imported into DQT to be a real date rather than a unix timestamp.
- Fix incorrect order of parameters to `join` in import script
Do not escape data being inserted in the issue tracker, it gets escaped on rendering.
Currently the numeric element type is only being added to the
instrument data dictionary if it's on the top page.

This fixes it so that the elements are always added to the dictionary
regardless of the page.
Properly handle parsing/auto-populating of visit label when there is a suffix after the visit label in the file name.

Fixes aces#8803
Some instruments use hidden fields to pass data to the frontend. This skips over the fields in the dictionary building to prevent a 500 error.
This fixes 2 problems with the SQL in the media FileUpload?action=getData
endpoint
1. There is an obvious SQL injection attack where user input from the
   request is directly concatenated into a string that's passed to the
   database.
2. There was an unnecessary sub-select that could have been a join

This whole section of the code is a mess that should to be re-written,
but this PR just tackles the urgent string concatenation.
Push 24.1.5 bugfixes into the 25.0.x release branch.
@driusan
Copy link
Collaborator Author

driusan commented Oct 3, 2023

@ridz1208 can you review?

@driusan driusan merged commit 56a636b into aces:25.0-release Oct 3, 2023
19 checks passed
@ridz1208 ridz1208 added this to the 25.0.1 milestone Nov 9, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants