Merge branch 'master' into develop

.github/workflows/php-test.yml

@@ -47,20 +47,20 @@ jobs:
             - uses: actions/checkout@v2
             - uses: actions/setup-node@v1
 
-            - name: Setup cache environment
-              id: cache-env
-              uses: shivammathur/cache-extensions@v1
-              with:
-                php-version: ${{ matrix.php-version }}
-                extensions: ${{ env.extensions }}
-                key: ${{ env.key }}
+#            - name: Setup cache environment
+#              id: cache-env
+#              uses: shivammathur/cache-extensions@v1
+#              with:
+#                php-version: ${{ matrix.php-version }}
+#                extensions: ${{ env.extensions }}
+#                key: ${{ env.key }}
 
-            - name: Cache extensions
-              uses: actions/cache@v1
-              with:
-                path: ${{ steps.cache-env.outputs.dir }}
-                key: ${{ steps.cache-env.outputs.key }}
-                restore-keys: ${{ steps.cache-env.outputs.key }}
+#            - name: Cache extensions
+#              uses: actions/cache@v1
+#              with:
+#                path: ${{ steps.cache-env.outputs.dir }}
+#                key: ${{ steps.cache-env.outputs.key }}
+#                restore-keys: ${{ steps.cache-env.outputs.key }}
 
             - name: Install PHP with extensions
               uses: shivammathur/setup-php@v2
@@ -87,10 +87,10 @@ jobs:
             - name: Install dependencies with composer
               run: composer update --prefer-dist --no-interaction --no-progress --optimize-autoloader --ansi
 
-            - name: Verify MySQL connection from host
-              run: |
-                sudo apt-get update && sudo apt-get install -y mysql-client
-                mysql --host 127.0.0.1 --port ${{ job.services.mysql.ports['3306'] }} -uroot -proot -e "SHOW DATABASES"
+#            - name: Verify MySQL connection from host
+#              run: |
+#                sudo apt-get update && sudo apt-get install -y mysql-client-8.0 mysql-common
+#                mysql --host 127.0.0.1 --port ${{ job.services.mysql.ports['3306'] }} -uroot -proot -e "SHOW DATABASES"
 
             - name: Install npm dependencies
               run: npm install

.htaccess.dist

@@ -1,8 +1,6 @@
 # check if RewriteModule is availbale
 <IfModule mod_rewrite.c>
-
-    # uncomment if using the AssetManager::linkAssets option 
-    #Options +FollowSymLinks
+    Options +FollowSymLinks
     
     RewriteEngine on
 

CHANGELOG.md

@@ -1,12 +1,32 @@
 HumHub Changelog
 ================
 
-1.10.2 (Unreleased)
+1.10.4 (Unreleased)
+-------------------
+- Fix #5480: `el` language file in Admin section broken
+- Fix #5479: Fix ContentContainerPermissionAccess without provided container
+
+
+1.10.3 (December 20, 2021)
 --------------------------
+
+See also: [HumHub 1.10 - Release Notes](https://docs.humhub.org/docs/about/releasenotes/release_notes_1_10) and [Changelog](https://github.com/humhub/humhub/blob/master/CHANGELOG.md). This release also includes a [security fix](https://github.com/humhub/humhub/security/advisories/GHSA-f5hc-5wfr-7v74). It could have been possible for registered users to become unauthorized members of private Spaces. Thanks to [Huntr](https://huntr.dev/bounties/943dad83-f0ed-4c74-ba81-7dfce7ca0ef2/) and @brenu.
+
+- Fix #5465: Fix empty RichText
+- Fix #5466: Default `.htaccess.dist` broken
+- Fix #5469: Mixed up title for Space membership button
+- Fix #5464: Fix comment highlighting on permalink
+- Fix #5473: Insufficient member invite check on Space creation 
+
+1.10.2 (December 7, 2021)
+-------------------------
+
+See also: [HumHub 1.10 - Release Notes](https://docs.humhub.org/docs/about/releasenotes/release_notes_1_10) and [Changelog](https://github.com/humhub/humhub/blob/master/CHANGELOG.md)
+
 - Fix #5450: Fix confirmation before close a form with unsaved changes on modal window
 - Fix #5453: Fix migration of default group
 - Enh #5461: Added Event after a new file content (new version) is stored
-- Enh #5457: Use permalink comment in notification
+- Enh #5457: Use permalink comment in notifications
 
 
 1.10.1 (November 26, 2021)

protected/humhub/modules/comment/models/Comment.php

@@ -223,21 +223,35 @@ class Comment extends ContentAddonActiveRecord implements ContentOwner
         $cacheID = sprintf(static::CACHE_KEY_LIMITED, $model, $id);
         $comments = $useCaching ? Yii::$app->cache->get($cacheID) : false;
 
-        if (!$useCaching || $comments === false) {
-            $commentCount = self::GetCommentCount($model, $id);
-
+        if ($comments === false) {
+            $objectCondition = ['object_model' => $model, 'object_id' => $id];
             $query = Comment::find();
-            $query->offset($commentCount - $limit);
             if ($currentCommentId && Comment::findOne(['id' => $currentCommentId])) {
-                $query->orderBy('`comment`.`id` <= ' . ($currentCommentId + intval($limit) - 1));
+                $nearCommentIds = Comment::find()
+                    ->select('id')
+                    ->where($objectCondition)
+                    ->andWhere(['<=', 'id', $currentCommentId])
+                    ->orderBy('created_at DESC')
+                    ->limit($limit)
+                    ->column();
+                if (count($nearCommentIds) < $limit) {
+                    $newerCommentIds = Comment::find()
+                        ->select('id')
+                        ->where($objectCondition)
+                        ->andWhere(['>', 'id', $currentCommentId])
+                        ->orderBy('created_at ASC')
+                        ->limit($limit - count($nearCommentIds))
+                        ->column();
+                    $nearCommentIds = array_merge($nearCommentIds, $newerCommentIds);
+                }
+                $query->where(['IN', 'id', $nearCommentIds]);
             } else {
-                $query->orderBy('created_at ASC');
+                $query->where($objectCondition);
+                $query->limit($limit);
             }
-            $query->limit($limit);
-            $query->where(['object_model' => $model, 'object_id' => $id]);
-            $query->joinWith('user');
+            $query->orderBy('created_at DESC, id dESC');
+            $comments = array_reverse($query->all());
 
-            $comments = $query->all();
             if ($useCaching) {
                 Yii::$app->cache->set($cacheID, $comments, Yii::$app->settings->get('cache.expireTime'));
             }

protected/humhub/modules/content/components/ContentContainerPermissionAccess.php

@@ -27,6 +27,7 @@ class ContentContainerPermissionAccess extends PermissionAccessValidator
 
     protected function verifyPermission($permission, $rule)
     {
-        return parent::verifyPermission($permission, $rule) || $this->contentContainer->can($permission, $rule);
+        return parent::verifyPermission($permission, $rule) ||
+            (($this->contentContainer instanceof ContentContainerActiveRecord) && $this->contentContainer->can($permission, $rule));
     }
 }

protected/humhub/modules/content/widgets/richtext/AbstractRichText.php

@@ -335,7 +335,7 @@ abstract class AbstractRichText extends JsWidget
      * In case of 'html' you can switch from only supporting basic HTML (e.g. used for mails) to extended HTML support by
      * setting the 'minimal' option to true. The result may differ between different RichText implementations.
      *
-     * @param string $content
+     * @param string|null $content
      * @param string $format
      * @param array $options
      * @return string
@@ -343,10 +343,14 @@ abstract class AbstractRichText extends JsWidget
      * @since 1.8
      * @see AbstractRichTextConverter
      */
-    public static function convert(string $content, $format = self::FORMAT_PLAINTEXT, $options = []) : string
+    public static function convert(?string $content, $format = self::FORMAT_PLAINTEXT, $options = []) : string
     {
         $converter = static::getConverter();
 
+        if ($content === null) {
+            $content = '';
+        }
+
         switch ($format) {
             case static::FORMAT_HTML:
                 return $converter->convertToHtml($content, $options);

protected/humhub/modules/space/controllers/CreateController.php

@@ -8,16 +8,14 @@
 
 namespace humhub\modules\space\controllers;
 
+use Colors\RandomColor;
 use humhub\components\Controller;
 use humhub\components\behaviors\AccessControl;
-use humhub\models\Setting;
-use humhub\modules\content\components\ContentContainerModule;
-use humhub\modules\content\components\ContentContainerModuleManager;
+use humhub\modules\space\models\forms\InviteForm;
 use humhub\modules\space\models\Space;
 use humhub\modules\space\permissions\CreatePrivateSpace;
 use humhub\modules\space\permissions\CreatePublicSpace;
-use humhub\modules\space\models\forms\InviteForm;
-use Colors\RandomColor;
+use humhub\modules\space\permissions\InviteUsers;
 use humhub\modules\user\helpers\AuthHelper;
 use Yii;
 use yii\base\Exception;
@@ -159,6 +157,10 @@ class CreateController extends Controller
             throw new HttpException(404);
         }
 
+        if (!$space->can(InviteUsers::class)) {
+            throw new HttpException(400, 'You are not allowed to invite users to the space!');
+        }
+
         $model = new InviteForm(['space' => $space]);
 
         if ($model->load(Yii::$app->request->post()) && $model->save()) {

protected/humhub/modules/space/widgets/views/membershipButton.php

@@ -36,7 +36,7 @@ if ($membership === null) {
     if ($canCancelMembership && $options['cancelMembership']['visible']) {
         echo Html::a($options['cancelMembership']['title'], '#', $options['cancelMembership']['attrs']);
     } elseif (!$canCancelMembership && $options['cannotCancelMembership']['visible']) {
-        $memberTitle = (!$space->isSpaceOwner() ? $options['cannotCancelMembership']['ownerTitle'] : $options['cannotCancelMembership']['memberTitle']);
+        $memberTitle = ($space->isSpaceOwner() ? $options['cannotCancelMembership']['ownerTitle'] : $options['cannotCancelMembership']['memberTitle']);
         echo Html::a($memberTitle, $space->createUrl(), $options['cannotCancelMembership']['attrs']);
     }
 }