Release/2.8.0

.github/workflows/build.yml

@@ -38,7 +38,7 @@ jobs:
           check_name: Java JUnit Test Results
           files: ./build/test-results/**/*.xml
       - name: Publish JUnit Test Results
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v3
         with:
           name: junit-java-test-results
           path: ./build/test-reports/
@@ -58,7 +58,7 @@ jobs:
       - name: Use Node.js
         uses: actions/setup-node@v3
         with:
-          node-version: 14.x
+          node-version: 22.9.0
       - name: Cache node modules
         id: nodeCache
         uses: actions/cache@v3
@@ -81,7 +81,7 @@ jobs:
           check_name: Java Script Mocha Unit Test Results
           files: ./scadalts-ui/test-results.xml
       - name: Publish Mocha Test Results
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v3
         with:
           name: mocha-js-test-results
           path: ./scadalts-ui/test-results.xml
@@ -166,7 +166,7 @@ jobs:
           key: ${{ runner.os }}-war-${{ github.run_id }}
           path: ./build/libs/Scada-LTS.war
       - name: Deploy WAR artifact
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v3
         with:
           name: Scada-LTS
           path: ./build/libs/Scada-LTS.war

.github/workflows/master.yml

@@ -54,7 +54,7 @@ jobs:
       - name: Use Node.js
         uses: actions/setup-node@v3
         with:
-          node-version: 14.x
+          node-version: 22.9.0
       - name: Cache node modules
         id: nodeCache
         uses: actions/cache@v3
@@ -151,7 +151,7 @@ jobs:
           key: ${{ runner.os }}-war-${{ github.run_id }}
           path: ./build/libs/Scada-LTS.war
       - name: Deploy WAR artifact
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v3
         with:
           name: Scada-LTS
           path: ./build/libs/Scada-LTS.war

.gitignore

@@ -96,6 +96,7 @@ catalina-jrebel.bat
 # Ignore Gradle project-specific cache directory
 .gradle
 gradle/
+!gradle/gradle-wrapper.properties
 # Ignore Gradle build output directory
 WebContent/resources/node_modules/
 build

WebContent/WEB-INF/dwr.xml

@@ -22,6 +22,8 @@
   <init>
     <converter id="localizableMessage" class="com.serotonin.web.dwr.LocalizableMessageConverter"/>
     <converter id="protocolVersionConverter" class="com.serotonin.mango.web.dwr.ProtocolVersionConverter"/>
+    <converter id="xssDataPointVoConverter" class="com.serotonin.mango.web.dwr.XssDataPointVoConverter"/>
+    <converter id="xssDataPointBeanConverter" class="com.serotonin.mango.web.dwr.XssDataPointBeanConverter"/>
   </init>
 
   <allow>
@@ -153,9 +155,12 @@
     <convert converter="bean" match="com.serotonin.mango.vo.publish.pachube.*"/>
     <convert converter="bean" match="com.serotonin.mango.vo.publish.persistent.*"/>
     <convert converter="bean" match="com.serotonin.mango.vo.report.*"/>
-    <convert converter="bean" match="com.serotonin.mango.vo.DataPointVO">
+    <convert converter="xssDataPointVoConverter" match="com.serotonin.mango.vo.DataPointVO">
       <param name="include" value="id,xid,name,extendedName,dataSourceId,enabled,dataTypeMessage,pointLocator"/>
     </convert>
+    <convert converter="xssDataPointBeanConverter" match="com.serotonin.mango.web.dwr.beans.DataPointBean">
+      <param name="include" value="id,xid,name,settable,dataType,dataTypeMessage,chartColour"/>
+    </convert>
     <convert converter="bean" match="com.serotonin.mango.vo.User">
       <param name="include" value="id,username,email,phone,admin,disabled,receiveAlarmEmails,receiveOwnAuditEvents,dataSourcePermissions,dataPointPermissions,userProfile,homeUrl,hideMenu,theme,firstName,lastName,enableFullScreen,hideShortcutDisableFullScreen"/>
     </convert>

WebContent/WEB-INF/ftl/report/reportChart.ftl

@@ -87,7 +87,7 @@
       <td>
         <table>
           <tr>
-            <td colspan="2"><h1>${instance.name}</h1></td>
+            <td colspan="2"><h1>${security.escapeHtml(instance.name)}</h1></td>
           </tr>
           <tr>
             <td class="label"><@fmt key="reports.runTimeStart"/></td>
@@ -121,7 +121,7 @@
 
       <td class="stats">
         <table>
-          <tr><td colspan="2" class="pointName">${point.name}</td></tr>
+          <tr><td colspan="2" class="pointName">${security.escapeHtml(point.name)}</td></tr>
           <tr>
             <td class="label"><@fmt key="reports.dataType"/></td>
             <td>${point.dataTypeDescription}</td>

WebContent/WEB-INF/jsp/_watchList.jsp

@@ -127,7 +127,7 @@
       function addPoint(point, parent) {
           var pointNode = dojo.widget.createWidget("TreeNode", {
                   title: "<img src='images/icon_comp.png'/> <span id='ph"+ point.key +"Name'>"+ point.value +"</span> "+
-                          "<img src='images/bullet_go.png' id='ph"+ point.key +"Image' title='<fmt:message key="watchlist.addToWatchlist"/>'/>",
+                          "<img src='images/bullet_go.png' id='ph"+ point.key +"Image' title='<spring:message code="watchlist.addToWatchlist"/>'/>",
                   object: point
           });
           parent.addChild(pointNode);
@@ -432,7 +432,7 @@
       <div dojoType="SplitContainer" orientation="horizontal" sizerWidth="3" activeSizing="true" class="borderDiv"
               widgetId="splitContainer" style="width: 100%; height: 500px;">
         <div dojoType="ContentPane" sizeMin="20" sizeShare="20" style="overflow:auto;padding:2px;">
-          <span class="smallTitle"><fmt:message key="watchlist.points"/></span> <tag:help id="watchListPoints"/> 
+          <span class="smallTitle"><spring:message code="watchlist.points"/></span> <tag:help id="watchListPoints"/>
           <tag:img id="addAllImg" png="icon_ds_go"
                       onclick="addAllPoints()" title="common.addAll" style="float:right;"/>
           <br/>
@@ -442,7 +442,7 @@
         <div dojoType="ContentPane" sizeMin="50" sizeShare="50" style="overflow:auto; padding:2px 10px 2px 2px;">
           <table cellpadding="0" cellspacing="0" width="100%">
             <tr>
-              <td class="smallTitle"><fmt:message key="watchlist.watchlist"/> <tag:help id="watchList"/></td>
+              <td class="smallTitle"><spring:message code="watchlist.watchlist"/> <tag:help id="watchList"/></td>
               <td align="right">
                 <sst:select id="watchListSelect" value="${selectedWatchList}" onchange="watchListChanged()"
                         onmouseover="closeLayers();">
@@ -455,10 +455,10 @@
                   <tag:img id="wlEditImg" png="pencil" title="watchlist.editListName"/>
                   <div id="wlEdit" style="visibility:hidden;left:0px;top:15px;" class="labelDiv"
                           onmouseout="hideLayer(this)">
-                    <fmt:message key="watchlist.newListName"/><br/>
+                    <spring:message code="watchlist.newListName"/><br/>
                     <input type="text" id="newWatchListName"
                             onkeypress="if (event.keyCode==13) $('saveWatchListNameLink').onclick();"/>
-                    <a class="ptr" id="saveWatchListNameLink" onclick="saveWatchListName()"><fmt:message key="common.save"/></a>
+                    <a class="ptr" id="saveWatchListNameLink" onclick="saveWatchListName()"><spring:message code="common.save"/></a>
                   </div>
                 </div>
 
@@ -519,7 +519,7 @@
             </table>
             <table id="watchListTable" width="100%"></table>
             <div id="emptyListMessage" style="color:#888888;padding:10px;text-align:center;">
-              <fmt:message key="watchlist.emptyList"/>
+              <spring:message code="watchlist.emptyList"/>
             </div>
           </div>
         </div>
@@ -530,7 +530,7 @@
       <div class="borderDiv" style="width: 100%;">
         <table width="100%">
           <tr>
-            <td class="smallTitle"><fmt:message key="watchlist.chart"/> <tag:help id="watchListCharts"/></td>
+            <td class="smallTitle"><spring:message code="watchlist.chart"/> <tag:help id="watchListCharts"/></td>
             <td align="right"><tag:dateRange/></td>
             <td><tag:img id="imageChartImg" png="control_play_blue" title="watchlist.imageChartButton"
                     onclick="getImageChart()"/></td>

WebContent/WEB-INF/jsp/app.jsp

@@ -1,5 +1,4 @@
 <!DOCTYPE html>
-<!DOCTYPE html>
 <html lang=en>
     <head>
         <meta charset=utf-8>

WebContent/WEB-INF/jsp/compoundEvents.jsp

@@ -129,11 +129,11 @@
                     editingCompoundEvent.id = response.data.cedId;
                     appendCompoundEvent(editingCompoundEvent.id);
                     startImageFader($("ced"+ editingCompoundEvent.id +"Img"));
-                    setUserMessage("<fmt:message key="compoundDetectors.cedAdded"/>");
+                    setUserMessage("<spring:message code="compoundDetectors.cedAdded"/>");
                     show($("deleteCompoundEventImg"));
                 }
                 else
-                    setUserMessage("<fmt:message key="compoundDetectors.cedSaved"/>");
+                    setUserMessage("<spring:message code="compoundDetectors.cedSaved"/>");
 
                 if (response.data.warning)
                     setUserMessage(response.data.warning);
@@ -184,7 +184,7 @@
                     setSelectionRange($("condition"), response.data.from, response.data.to);
             }
             else
-                setUserMessage("<fmt:message key="compoundDetectors.cedValidated"/>");
+                setUserMessage("<spring:message code="compoundDetectors.cedValidated"/>");
         });
     }
 
@@ -200,7 +200,7 @@
           <table width="100%">
             <tr>
               <td>
-                <span class="smallTitle"><fmt:message key="compoundDetectors.compoundEventDetectors"/></span>
+                <span class="smallTitle"><spring:message code="compoundDetectors.compoundEventDetectors"/></span>
                 <tag:help id="compoundEventDetectors"/>
               </td>
               <td align="right"><tag:img png="multi_bell_add" title="common.add" id="ced${NEW_ID}Img"
@@ -222,7 +222,7 @@
         <div class="borderDiv">
           <table width="100%">
             <tr>
-              <td><span class="smallTitle"><fmt:message key="compoundDetectors.details"/></span></td>
+              <td><span class="smallTitle"><spring:message code="compoundDetectors.details"/></span></td>
               <td align="right">
                 <tag:img png="save" onclick="saveCompoundEvent();" title="common.save"/>
                 <tag:img id="deleteCompoundEventImg" png="delete" onclick="deleteCompoundEvent();" title="common.delete"/>
@@ -232,17 +232,17 @@
 
           <table>
             <tr>
-              <td class="formLabelRequired"><fmt:message key="common.xid"/></td>
+              <td class="formLabelRequired"><spring:message code="common.xid"/></td>
               <td class="formField"><input type="text" id="xid"/></td>
             </tr>
 
             <tr>
-              <td class="formLabelRequired"><fmt:message key="compoundDetectors.name"/></td>
+              <td class="formLabelRequired"><spring:message code="compoundDetectors.name"/></td>
               <td class="formField"><input type="text" id="name"/></td>
             </tr>
 
             <tr>
-              <td class="formLabelRequired"><fmt:message key="common.alarmLevel"/></td>
+              <td class="formLabelRequired"><spring:message code="common.alarmLevel"/></td>
               <td class="formField">
                 <select id="alarmLevel" onchange="updateAlarmLevelImage(this.value)">
                   <tag:alarmLevelOptions/>
@@ -252,24 +252,24 @@
             </tr>
 
             <tr>
-              <td class="formLabelRequired"><fmt:message key="common.rtn"/></td>
+              <td class="formLabelRequired"><spring:message code="common.rtn"/></td>
               <td class="formField"><input type="checkbox" id="rtn"/></td>
             </tr>
 
             <tr>
               <td class="formLabelRequired">
-                <fmt:message key="compoundDetectors.condition"/>
+                <spring:message code="compoundDetectors.condition"/>
                 <tag:img png="accept" onclick="validate();" title="compoundDetectors.validate"/><br/>
                 <br/>
-                <a href="#" onclick="insertText(' && '); return false;"><fmt:message key="compoundDetectors.and"/></a><br/>
-                <a href="#" onclick="insertText(' || '); return false;"><fmt:message key="compoundDetectors.or"/></a><br/>
-                <a href="#" onclick="insertText('!'); return false;"><fmt:message key="compoundDetectors.not"/></a><br/>
+                <a href="#" onclick="insertText(' && '); return false;"><spring:message code="compoundDetectors.and"/></a><br/>
+                <a href="#" onclick="insertText(' || '); return false;"><spring:message code="compoundDetectors.or"/></a><br/>
+                <a href="#" onclick="insertText('!'); return false;"><spring:message code="compoundDetectors.not"/></a><br/>
               </td>
               <td class="formField"><textarea rows="10" cols="60" id="condition"></textarea></td>
             </tr>
 
             <tr>
-              <td class="formLabelRequired"><fmt:message key="common.disabled"/></td>
+              <td class="formLabelRequired"><spring:message code="common.disabled"/></td>
               <td class="formField"><input type="checkbox" id="disabled"/></td>
             </tr>
           </table>
@@ -286,12 +286,12 @@
     <tr>
       <td valign="top" style="display:none;" id="eventTypes">
         <div class="borderDivPadded">
-          <span class="smallTitle"><fmt:message key="compoundDetectors.eventTypes"/></span>
+          <span class="smallTitle"><spring:message code="compoundDetectors.eventTypes"/></span>
           <div dojoType="TreeBasicController" widgetId="controller"></div>
           <div id="tree">
             <div dojoType="Tree" widgetId="eventTypeTree" listeners="controller" toggle="wipe">
-              <div dojoType="TreeNode" title="<fmt:message key="compoundDetectors.pointEventDetector"/>" widgetId="rootPoint"></div>
-              <div dojoType="TreeNode" title="<fmt:message key="scheduledEvents.ses"/>" widgetId="rootScheduled"></div>
+              <div dojoType="TreeNode" title="<spring:message code="compoundDetectors.pointEventDetector"/>" widgetId="rootPoint"></div>
+              <div dojoType="TreeNode" title="<spring:message code="scheduledEvents.ses"/>" widgetId="rootScheduled"></div>
             </div>
           </div>
         </div>