Release OpenProject 15.1.1

app/components/work_package_relations_tab/add_work_package_child_form_component.rb

@@ -47,6 +47,6 @@ def initialize(work_package:, base_errors: nil)
 
   def submit_url_options
     { method: :post,
-      url: work_package_children_path(@work_package) }
+      url: work_package_children_relations_path(@work_package) }
   end
 end

app/components/work_package_relations_tab/index_component.html.erb

@@ -37,7 +37,7 @@
             if should_render_add_child?
               menu.with_item(
                 label: t("#{I18N_NAMESPACE}.relations.label_child_singular").capitalize,
-                href: new_work_package_child_path(@work_package),
+                href: new_work_package_children_relation_path(@work_package),
                 test_selector: new_button_test_selector(relation_type: :child),
                 content_arguments: {
                   data: { turbo_stream: true }

app/components/work_package_relations_tab/index_component.rb

@@ -27,6 +27,8 @@ def self.wrapper_key
   private
 
   def should_render_add_child?
+    return false if @work_package.milestone?
+
     helpers.current_user.allowed_in_project?(:manage_subtasks, @work_package.project)
   end
 

app/components/work_package_relations_tab/relation_component.rb

@@ -85,7 +85,7 @@ def edit_path
 
   def destroy_path
     if parent_child_relationship?
-      work_package_child_path(@work_package, @child)
+      work_package_children_relation_path(@work_package, @child)
     else
       work_package_relation_path(@work_package, @relation)
     end

app/controllers/custom_fields_controller.rb

@@ -30,14 +30,17 @@ class CustomFieldsController < ApplicationController
   include CustomFields::SharedActions # share logic with ProjectCustomFieldsControlller
   layout "admin"
 
+  # rubocop:disable Rails/LexicallyScopedActionFilter
   before_action :require_admin
   before_action :find_custom_field, only: %i(edit update destroy delete_option reorder_alphabetical)
   before_action :prepare_custom_option_position, only: %i(update create)
   before_action :find_custom_option, only: :delete_option
+  before_action :validate_enterprise_token, only: %i(create)
+  # rubocop:enable Rails/LexicallyScopedActionFilter
 
   def index
     # loading wp cfs exclicity to allow for eager loading
-    @custom_fields_by_type = CustomField.all
+    @custom_fields_by_type = CustomField
       .where.not(type: ["WorkPackageCustomField", "ProjectCustomField"])
       .group_by { |f| f.class.name }
 
@@ -64,6 +67,12 @@ def show_local_breadcrumb
     false
   end
 
+  def validate_enterprise_token
+    if params.dig(:custom_field, :field_format) == "hierarchy" && !EnterpriseToken.allows_to?(:custom_field_hierarchies)
+      render_403
+    end
+  end
+
   def find_custom_field
     @custom_field = CustomField.find(params[:id])
   rescue ActiveRecord::RecordNotFound

app/controllers/work_package_children_controller.rb → app/controllers/work_package_children_relations_controller.rb

@@ -28,78 +28,62 @@
 # See COPYRIGHT and LICENSE files for more details.
 #++
 
-class WorkPackageChildrenController < ApplicationController
+class WorkPackageChildrenRelationsController < ApplicationController
   include OpTurbo::ComponentStream
   include OpTurbo::DialogStreamHelper
 
   before_action :set_work_package
 
   before_action :authorize # Short-circuit early if not authorized
 
-  before_action :set_child, except: %i[new create]
-  before_action :set_relations, except: %i[new create]
-
   def new
     component = WorkPackageRelationsTab::AddWorkPackageChildDialogComponent
       .new(work_package: @work_package)
     respond_with_dialog(component)
   end
 
   def create
-    target_work_package_id = params[:work_package][:id]
-    target_child_work_package = WorkPackage.find(target_work_package_id)
+    child = WorkPackage.find(params[:work_package][:id])
+    service_result = set_relation(child:, parent: @work_package)
 
-    target_child_work_package.parent = @work_package
+    respond_with_relations_tab_update(service_result)
+  end
 
-    if target_child_work_package.save
-      @children = @work_package.children.visible
-      @relations = @work_package.relations.visible
+  def destroy
+    child = WorkPackage.find(params[:id])
+    service_result = set_relation(child:, parent: nil)
 
-      component = WorkPackageRelationsTab::IndexComponent.new(
-        work_package: @work_package,
-        relations: @relations,
-        children: @children
-      )
-      replace_via_turbo_stream(component:)
-      update_flash_message_via_turbo_stream(
-        message: I18n.t(:notice_successful_update), scheme: :success
-      )
-      respond_with_turbo_streams
-    end
+    respond_with_relations_tab_update(service_result)
   end
 
-  def destroy
-    @child.parent = nil
+  private
 
-    if @child.save
+  def set_relation(child:, parent:)
+    WorkPackages::UpdateService.new(user: current_user, model: child)
+                               .call(parent:)
+  end
+
+  def respond_with_relations_tab_update(service_result)
+    if service_result.success?
       @work_package.reload
-      @children = @work_package.children.visible
       component = WorkPackageRelationsTab::IndexComponent.new(
         work_package: @work_package,
-        relations: @relations,
-        children: @children
+        relations: @work_package.relations.visible,
+        children: @work_package.children.visible
       )
       replace_via_turbo_stream(component:)
       update_flash_message_via_turbo_stream(
         message: I18n.t(:notice_successful_update), scheme: :success
       )
 
       respond_with_turbo_streams
+    else
+      respond_with_turbo_streams(status: :unprocessable_entity)
     end
   end
 
-  private
-
   def set_work_package
     @work_package = WorkPackage.find(params[:work_package_id])
     @project = @work_package.project
   end
-
-  def set_child
-    @child = WorkPackage.find(params[:id])
-  end
-
-  def set_relations
-    @relations = @work_package.relations.visible
-  end
 end

app/controllers/work_package_relations_controller.rb

@@ -62,8 +62,8 @@ def create
     if service_result.success?
       @work_package.reload
       component = WorkPackageRelationsTab::IndexComponent.new(work_package: @work_package,
-                                                              relations: @work_package.relations,
-                                                              children: @work_package.children)
+                                                              relations: @work_package.relations.visible,
+                                                              children: @work_package.children.visible)
       replace_via_turbo_stream(component:)
       respond_with_turbo_streams
     else
@@ -80,8 +80,8 @@ def update
     if service_result.success?
       @work_package.reload
       component = WorkPackageRelationsTab::IndexComponent.new(work_package: @work_package,
-                                                              relations: @work_package.relations,
-                                                              children: @work_package.children)
+                                                              relations: @work_package.relations.visible,
+                                                              children: @work_package.children.visible)
       replace_via_turbo_stream(component:)
       respond_with_turbo_streams
     else
@@ -93,11 +93,12 @@ def destroy
     service_result = Relations::DeleteService.new(user: current_user, model: @relation).call
 
     if service_result.success?
-      @children = WorkPackage.where(parent_id: @work_package.id)
+      @children = WorkPackage.where(parent_id: @work_package.id).visible
       @relations = @work_package
         .relations
         .reload
         .includes(:to, :from)
+        .visible
 
       component = WorkPackageRelationsTab::IndexComponent.new(work_package: @work_package,
                                                               relations: @relations,

app/controllers/work_package_relations_tab_controller.rb

@@ -33,9 +33,10 @@ class WorkPackageRelationsTabController < ApplicationController
   before_action :authorize_global
 
   def index
-    @children = WorkPackage.where(parent_id: @work_package.id)
+    @children = WorkPackage.where(parent_id: @work_package.id).visible
     @relations = @work_package
       .relations
+      .visible
       .includes(:to, :from)
 
     component = WorkPackageRelationsTab::IndexComponent.new(

app/services/principals/replace_references_service.rb

@@ -43,6 +43,7 @@ def call(from:, to:)
 
     def rewrite_active_models(from, to)
       rewrite_author(from, to)
+      rewrite_creator(from, to)
       rewrite_user(from, to)
       rewrite_assigned_to(from, to)
       rewrite_responsible(from, to)
@@ -92,6 +93,12 @@ def rewrite_author(from, to)
       end
     end
 
+    def rewrite_creator(from, to)
+      [AuthProvider].each do |klass|
+        rewrite(klass, :creator_id, from, to)
+      end
+    end
+
     def rewrite_user(from, to)
       [TimeEntry,
        CostEntry,
@@ -149,7 +156,7 @@ def journal_classes
     end
 
     def foreign_keys
-      %w[author_id user_id assigned_to_id responsible_id logged_by_id presenter_id]
+      %w[author_id creator_id user_id assigned_to_id responsible_id logged_by_id presenter_id]
     end
 
     def rewrite(klass, attribute, from, to)

app/views/wiki/export_multiple.html.erb

@@ -53,7 +53,7 @@ See COPYRIGHT and LICENSE files for more details.
     <% @pages.each do |page| %>
       <hr />
       <a name="<%= h(page.to_param) %>" />
-        <%= format_text page.content ,:text, wiki_links: :anchor %>
+        <%= format_text page ,:text, wiki_links: :anchor %>
       <% end %>
     </body>
   </html>

app/workers/principals/delete_job.rb

@@ -66,6 +66,7 @@ def delete_associated(principal)
     delete_notifications(principal)
     delete_private_queries(principal)
     delete_tokens(principal)
+    delete_favorites(principal)
   end
 
   def delete_notifications(principal)
@@ -77,6 +78,10 @@ def delete_private_queries(principal)
     CostQuery.where(user_id: principal.id, is_public: false).delete_all
   end
 
+  def delete_favorites(principal)
+    Favorite.where(user_id: principal.id).delete_all
+  end
+
   def delete_tokens(principal)
     ::Token::Base.where(user_id: principal.id).destroy_all
   end

config/initializers/menus.rb

@@ -675,7 +675,7 @@
             { tab: :relations },
             skip_permissions_check: true,
             badge: ->(work_package:, **) {
-              work_package.relations.count + work_package.children.count
+              work_package.relations.visible.count + work_package.children.visible.count
             },
             caption: :"js.work_packages.tabs.relations"
   menu.push :watchers,

config/initializers/permissions.rb

@@ -326,7 +326,7 @@
 
       wpt.permission :manage_subtasks,
                      {
-                       work_package_children: %i[new create destroy]
+                       work_package_children_relations: %i[new create destroy]
                      },
                      permissible_on: :project,
                      dependencies: :view_work_packages

config/locales/crowdin/de.yml

@@ -218,7 +218,7 @@ de:
           heading: Für alle Projekte
           description: Dieses Projekt-Attribut ist in allen Projekten aktiviert, da die Option "Für alle Projekte" aktiviert ist. Es kann nicht für einzelne Projekte deaktiviert werden.
       items:
-        actions: "Element-Aktionen"
+        actions: "Aktionen"
         blankslate:
           root:
             title: "Ihre Liste der Elemente ist leer"
@@ -651,7 +651,7 @@ de:
       follows_description: "Das verknüpfte Arbeitspaket muss beendet sein bevor dieses Arbeitspaket starten kann"
       label_child_singular: "Untergeordnetes Arbeitspaket"
       label_child_plural: "Untergeordnete Arbeitspakete"
-      child_description: "Makes the related work package a sub-item of the current (parent) work package"
+      child_description: "Macht das zugehörige Arbeitspaket zu einem Unterelement des aktuellen (übergeordneten) Arbeitspakets"
       label_blocks_singular: "Blockiert"
       label_blocks_plural: "Blockiert"
       blocks_description: "Das verknüpfte Arbeitspaket kann erst geschlossen werden, wenn dieses Arbeitspaket geschlossen ist"
@@ -1822,7 +1822,7 @@ de:
             label: "XLS"
       columns:
         input_label_report: "Spalten zur Attributtabelle hinzufügen"
-        input_caption_report: "Standardmäßig sind alle Attribute, die als Spalten in der Arbeitspaketliste hinzugefügt wurden, ausgewählt. Textfelder sind in der Attribut-Tabelle nicht verfügbar, können aber unterhalb der Tabelle angezeigt werden."
+        input_caption_report: "Standardmäßig sind alle Attribute, die als Spalten in der Arbeitspaketliste hinzugefügt wurden, ausgewählt. Langtextfelder sind in der Attributtabelle nicht verfügbar, können aber unterhalb der Tabelle angezeigt werden."
         input_caption_table: "Standardmäßig sind alle Attribute, die als Spalten in der Arbeitspaketliste hinzugefügt wurden, ausgewählt. Textfelder sind in tabellenbasierten Exporten nicht verfügbar."
       pdf:
         export_type:

config/locales/crowdin/js-fr.yml

@@ -280,7 +280,7 @@ fr:
           Voulez-vous continuer ?
       work_packages_settings:
         warning_progress_calculation_mode_change_from_status_to_field_html: >-
-          Passer du mode de calcul de la progression basé sur le statut au mode basé sur le travail transformera <i>% réalisé</i> en champ librement modifiable. Si vous complétez les champs <i>Travail</i> et <i>Travail restant</i>, ils seront également liés à <i>% réalisé</i>. Changer le champ <i>Travail restant</i> peut alors changer le <i>% réalisé</i>.
+          Passer du mode de calcul de la progression basé sur le statut au mode basé sur le travail transformera <i>% réalisé</i> en champ librement modifiable. Si vous complétez les champs <i>Travail</i> et <i>Travail restant</i>, ils seront également liés à <i>% réalisé</i>. Changer le champ <i>Travail restant</i> peut alors changer le <i>% réalisé</i>.
         warning_progress_calculation_mode_change_from_field_to_status_html: >-
           Passer du mode de calcul de la progression basé sur le travail au mode basé sur le statut entraînera la perte de toutes les valeurs de <i>% réalisé</i> existantes et leur remplacement par les valeurs associées à chaque statut. Les valeurs existantes pour <i>Travail restant</i> peuvent également être recalculées pour refléter ce changement. Cette action est irréversible.
     custom_actions:

config/locales/crowdin/js-mn.yml

@@ -102,7 +102,7 @@ mn:
     button_save: "Save"
     button_settings: "Settings"
     button_uncheck_all: "Uncheck all"
-    button_update: "Update"
+    button_update: "Шинэчлэх"
     button_export-pdf: "Download PDF"
     button_export-atom: "Download Atom"
     button_generate_pdf: "Generate PDF"