Merge remote-tracking branch 'origin/release/17.7' into release/17.8

Author: oliverguenther

app/mailers/interceptors/remove_blocked_recipients.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+#-- copyright
+# OpenProject is an open source project management software.
+# Copyright (C) the OpenProject GmbH
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License version 3.
+#
+# OpenProject is a fork of ChiliProject, which is a fork of Redmine. The copyright follows:
+# Copyright (C) 2006-2013 Jean-Philippe Lang
+# Copyright (C) 2010-2013 the ChiliProject Team
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+#
+# See COPYRIGHT and LICENSE files for more details.
+#++
+
+module Interceptors
+  # Removes recipients on a domain listed in the `blocked_email_domains` setting.
+  # The validation on User only applies to addresses as they are entered, so this
+  # covers users whose domain was blocked after their account already existed.
+  #
+  # Mails left without any recipient are dropped by DoNotSendMailsWithoutRecipient,
+  # which is why this has to run before it.
+  module RemoveBlockedRecipients
+    FIELDS = %i[to cc bcc].freeze
+
+    module_function
+
+    def delivering_email(mail)
+      domains = ::OpenProject::BlockedEmailDomains.domains
+
+      return if domains.empty?
+
+      FIELDS.each { |field| remove_blocked(mail, field, domains) }
+    end
+
+    def remove_blocked(mail, field, domains)
+      addresses = Array(mail.send(field))
+      allowed = addresses.reject { |address| ::OpenProject::BlockedEmailDomains.blocked?(address, domains:) }
+
+      return if allowed.size == addresses.size
+
+      Rails.logger.info do
+        "Removed blocked #{field} recipients from '#{mail.subject}': #{(addresses - allowed).join(', ')}"
+      end
+
+      mail.send(:"#{field}=", allowed)
+    end
+  end
+end

app/models/user.rb

@@ -185,6 +185,8 @@ def self.blocked_condition(blocked)
 
   validates :mail, email: true, unless: Proc.new { |user| user.mail.blank? }
   validates :mail, length: { maximum: 256, allow_nil: true }
+  # Only on change so that blocking a domain does not make its existing users unsaveable
+  validates :mail, blocked_email_domain: true, if: Proc.new { |user| user.mail_changed? }
 
   validates :password,
             confirmation: {

app/validators/blocked_email_domain_validator.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+#-- copyright
+# OpenProject is an open source project management software.
+# Copyright (C) the OpenProject GmbH
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License version 3.
+#
+# OpenProject is a fork of ChiliProject, which is a fork of Redmine. The copyright follows:
+# Copyright (C) 2006-2013 Jean-Philippe Lang
+# Copyright (C) 2010-2013 the ChiliProject Team
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+#
+# See COPYRIGHT and LICENSE files for more details.
+#++
+
+# Rejects email addresses whose domain is listed in the `blocked_email_domains` setting.
+class BlockedEmailDomainValidator < ActiveModel::EachValidator
+  def validate_each(record, attribute, value)
+    return if value.blank?
+    return unless OpenProject::BlockedEmailDomains.blocked?(value)
+
+    record.errors.add attribute, :blocked_domain
+  end
+end

config/constants/settings/definition.rb

@@ -219,6 +219,12 @@ class Definition
       bcc_recipients: {
         default: true
       },
+      blocked_email_domains: {
+        format: :array,
+        description: "Email domains that may not be used for user accounts. Subdomains are blocked as well. " \
+                     "Recipients on these domains are also skipped when sending emails.",
+        default: []
+      },
       boards_demo_data_available: {
         description: "Internal setting determining availability of demo seed data",
         default: false

config/initializers/register_mail_interceptors.rb

@@ -32,6 +32,7 @@
 # Do this here, so they aren't registered multiple times due to reloading in development mode.
 Rails.application.reloader.to_prepare do
   ApplicationMailer.register_interceptor Interceptors::DefaultHeaders
+  ApplicationMailer.register_interceptor Interceptors::RemoveBlockedRecipients
   # following needs to be the last interceptor
   ApplicationMailer.register_interceptor Interceptors::DoNotSendMailsWithoutRecipient
 end

config/locales/en.yml

@@ -499,6 +499,7 @@ en:
         before_or_equal_to: "must be before or equal to %{date}."
         blank: "can't be blank."
         blank_nested: "needs to have the property '%{property}' set."
+        blocked_domain: "is not allowed. Please use an email address from a different domain."
         cannot_delete_mapping: "is required. Cannot be deleted."
         cant_link_a_work_package_with_a_descendant: "A work package cannot be linked to one of its subtasks."
         circular_dependency: "This relation would create a circular dependency."

docker/prod/Dockerfile

@@ -146,7 +146,7 @@ ENV OPENPROJECT_RAILS__CACHE__STORE=memcache
 ENV DATABASE_URL=postgres://openproject:openproject@127.0.0.1/openproject
 ENV PGDATA=/var/openproject/pgdata
 
-COPY --from=openproject/hocuspocus:17.7.1 --chown=$APP_USER:$APP_USER /app /opt/hocuspocus
+COPY --from=openproject/hocuspocus:17.7.2 --chown=$APP_USER:$APP_USER /app /opt/hocuspocus
 # Keep node/npm in all-in-one for bundled hocuspocus even when BIM support is disabled.
 COPY --from=build-base /usr/local/bin/node /usr/local/bin/node
 COPY --from=build-base /usr/local/lib/node_modules /usr/local/lib/node_modules

docs/installation-and-operations/configuration/environment/README.md

@@ -162,6 +162,7 @@ OPENPROJECT_BACKUP__INCLUDE__ATTACHMENTS (default=true) Allow inclusion of attac
 OPENPROJECT_BACKUP__INITIAL__WAITING__PERIOD (default=86400) Wait time before newly created backup tokens are usable
 OPENPROJECT_BCC__RECIPIENTS (default=true) Blind carbon copy recipients (bcc)
 OPENPROJECT_BLACKLISTED__ROUTES (default=[]) Blocked routes to prevent access to certain modules or pages
+OPENPROJECT_BLOCKED__EMAIL__DOMAINS (default=[]) Email domains that may not be used for user accounts. Subdomains are blocked as well. Recipients on these domains are also skipped when sending emails.
 OPENPROJECT_BOARDS__DEMO__DATA__AVAILABLE (default=false) Internal setting determining availability of demo seed data
 OPENPROJECT_BRUTE__FORCE__BLOCK__AFTER__FAILED__LOGINS (default=20) Number of login attempts per user before assuming brute force attack
 OPENPROJECT_BRUTE__FORCE__BLOCK__MINUTES (default=30) Number of minutes to block users after presumed brute force attack

docs/release-notes/17-7-2/README.md

@@ -0,0 +1,31 @@
+---
+title: OpenProject 17.7.2
+sidebar_navigation:
+    title: 17.7.2
+release_version: 17.7.2
+release_date: 2026-08-13
+---
+
+# OpenProject 17.7.2
+
+Release date: 2026-08-13
+
+We released [OpenProject 17.7.2](https://community.openproject.org/versions/2321).
+The release contains several bug fixes and we recommend updating to the newest version.
+Below you will find a complete list of all changes and bug fixes.
+<!-- BEGIN SECURITY FIXES AUTOMATED SECTION -->
+<!-- END SECURITY FIXES AUTOMATED SECTION -->
+<!--more-->
+
+## Bug fixes and changes
+
+<!-- Warning: Anything within the below lines will be automatically removed by the release script -->
+<!-- BEGIN AUTOMATED SECTION -->
+
+- Bugfix: The hourly rate cannot be adjusted for individual projects \[[#78111](https://community.openproject.org/wp/78111)\]
+- Bugfix: Non-working days saved while reschedule job is running are not applied to work packages \[[#78219](https://community.openproject.org/wp/78219)\]
+- Bugfix: Bubble with + in timeline view does not make sense \[[#78284](https://community.openproject.org/wp/78284)\]
+- Bugfix: When using multiple seeded custom styles, most are lost \[[#78397](https://community.openproject.org/wp/78397)\]
+
+<!-- END AUTOMATED SECTION -->
+<!-- Warning: Anything above this line will be automatically removed by the release script -->

docs/release-notes/README.md

@@ -13,6 +13,13 @@ Stay up to date and get an overview of the new features included in the releases
 <!--- New release notes are generated below. Do not remove comment. -->
 <!--- RELEASE MARKER -->
 
+## 17.7.2
+
+Release date: 2026-08-13
+
+[Release Notes](17-7-2/)
+
+
 ## 17.7.1
 
 Release date: 2026-08-06