Release OpenProject 17.0.2

Author: oliverguenther

.github/workflows/docker.yml

@@ -103,7 +103,7 @@ jobs:
           ./docker/prod/setup/precompile-assets.sh
           # public/assets will be saved as artifact, so temporarily copying config file there as well
           cp config/frontend_assets.manifest.json public/assets/frontend_assets.manifest.json
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v6
         with:
           path: public/
           name: public-assets-${{ inputs.tag }}-${{ github.sha }}
@@ -163,7 +163,7 @@ jobs:
         run: |
           cp ./docker/prod/Dockerfile ./Dockerfile
       - name: Download precompiled public assets
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v7
         with:
           name: public-assets-${{ inputs.tag }}-${{ github.sha }}
           path: public/
@@ -208,7 +208,7 @@ jobs:
             ${{ needs.setup.outputs.registry_image }}
       - name: Restore vendor/bundle
         id: restore-vendor-bundle
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         with:
           path: |
             vendor/bundle
@@ -243,7 +243,7 @@ jobs:
           docker rm bundle
       - name: Save vendor/bundle
         id: save-vendor-bundle
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@v5
         with:
           path: |
             vendor/bundle
@@ -292,9 +292,9 @@ jobs:
           digest="${{ steps.push.outputs.digest }}"
           touch "/tmp/digests/${digest#sha256:}"
       - name: Upload digest
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6
         with:
-          name: digests-${{ inputs.tag }}-${{ matrix.target }}-${{ matrix.digest }}
+          name: digests-${{ inputs.tag }}-${{ matrix.target }}--${{ matrix.digest }}
           path: /tmp/digests/*
           if-no-files-found: error
           retention-days: 1
@@ -308,13 +308,13 @@ jobs:
       - build
     steps:
       - name: Merge digests
-        uses: actions/upload-artifact/merge@v5
+        uses: actions/upload-artifact/merge@v6
         with:
-          pattern: "digests-${{ inputs.tag }}-${{ matrix.target }}-${{ matrix.digest }}*"
+          pattern: "digests-${{ inputs.tag }}-${{ matrix.target }}--*"
           overwrite: true
           name: "merged-digests-${{ inputs.tag }}-${{ matrix.target }}-${{ github.run_number }}-${{ github.run_attempt }}"
       - name: Download digests
-        uses: actions/download-artifact@v6
+        uses: actions/download-artifact@v7
         with:
           name: "merged-digests-${{ inputs.tag }}-${{ matrix.target }}-${{ github.run_number }}-${{ github.run_attempt }}"
           path: /tmp/digests

app/components/open_project/common/main_menu_toggle_component.rb

@@ -31,47 +31,31 @@
 module OpenProject
   module Common
     class MainMenuToggleComponent < ApplicationComponent
-      def initialize(expanded:)
+      include Primer::AttributesHelper
+
+      def initialize(expanded:, **system_arguments)
         super()
 
-        @expanded = expanded
+        @system_arguments = system_arguments
+        @system_arguments[:scheme] = :invisible
+        @system_arguments[:icon] = expanded ? :"sidebar-expand" : :"sidebar-collapse"
+        @system_arguments[:size] = expanded ? :medium : :small
+        @system_arguments[:id]   = "menu-toggle--#{expanded ? 'collapse-button' : 'expand-button'}"
+        @system_arguments[:data] = merge_data(
+          @system_arguments,
+          data: { action: "click->menus--main-toggle#toggleNavigation" }
+        )
+        @system_arguments[:aria] = merge_aria(
+          @system_arguments,
+          aria: {
+            expanded:,
+            label: expanded ? I18n.t("js.label_hide_project_menu") : I18n.t("js.label_expand_project_menu")
+          }
+        )
       end
 
       def call
-        render(Primer::Beta::IconButton.new(icon:,
-                                            id:,
-                                            aria: { label: aria_label },
-                                            scheme:,
-                                            size:,
-                                            data:))
-      end
-
-      private
-
-      def icon
-        @expanded ? "sidebar-expand" : :"sidebar-collapse"
-      end
-
-      def id
-        "menu-toggle--#{@expanded ? 'collapse-button' : 'expand-button'}"
-      end
-
-      def aria_label
-        @expanded ? I18n.t("js.label_hide_project_menu") : I18n.t("js.label_expand_project_menu")
-      end
-
-      def scheme
-        :invisible
-      end
-
-      def size
-        @expanded ? :medium : :small
-      end
-
-      def data
-        {
-          action: "click->menus--main-toggle#toggleNavigation"
-        }
+        render(Primer::Beta::IconButton.new(**@system_arguments))
       end
     end
   end

app/components/projects/project_creation_footer_component.rb

@@ -76,7 +76,7 @@ def submit_button_args
     end
 
     def total_steps
-      template.nil? && project.available_custom_fields.required.any? ? 3 : 2
+      template.nil? && project.available_custom_fields.for_all.required.any? ? 3 : 2
     end
   end
 end

app/components/users/row_component.rb

@@ -79,15 +79,25 @@ def button_links
     end
 
     def status_link
-      # Don't show for current user
-      return if user.id == table.current_user.id
-
-      # Don't show if non-admin
-      return unless table.current_user.admin?
+      return if user_is_current_user?
+      return unless current_user_allowed_to_manage_users?
+      return if user_is_admin_and_current_user_is_no_admin?
 
       helpers.change_user_status_links user
     end
 
+    def user_is_current_user?
+      user.id == table.current_user.id
+    end
+
+    def current_user_allowed_to_manage_users?
+      table.current_user.allowed_globally?(:manage_user)
+    end
+
+    def user_is_admin_and_current_user_is_no_admin?
+      user.admin? && !table.current_user.admin?
+    end
+
     def column_css_class(column)
       if column == :mail
         "email"

app/controllers/repositories_controller.rb

@@ -233,7 +233,7 @@ def diff
       end
 
       filename = "changeset_r#{@rev}"
-      filename << "_r#{@rev_to}" if @rev_to
+      filename += "_r#{@rev_to}" if @rev_to
       send_data @diff.join,
                 filename: "#{filename}.diff",
                 type: "text/x-patch",

app/controllers/users_controller.rb

@@ -157,6 +157,14 @@ def change_status_info
   def change_status # rubocop:disable Metrics/AbcSize, Metrics/PerceivedComplexity
     if @user.id == current_user.id
       # user is not allowed to change own status
+      flash[:error] = I18n.t("user.error_status_change_self")
+      redirect_back_or_default({ action: "edit", id: @user })
+      return
+    end
+
+    if @user.admin? && !current_user.admin?
+      # non-admin users are not allowed to change admin status
+      flash[:error] = I18n.t("user.error_admin_change_on_non_admin")
       redirect_back_or_default({ action: "edit", id: @user })
       return
     end
@@ -167,23 +175,28 @@ def change_status # rubocop:disable Metrics/AbcSize, Metrics/PerceivedComplexity
       return redirect_back_or_default({ action: "edit", id: @user })
     end
 
+    activated_account = false
+
     if params[:unlock]
       @user.failed_login_count = 0
       @user.activate
+      activated_account = true
     elsif params[:lock]
       @user.lock
     elsif params[:activate]
       @user.activate
+      activated_account = true
     end
+
     # Was the account activated? (do it before User#save clears the change)
-    was_activated = (@user.status_change == %w[registered active])
+    should_deliver_activation_mail = (@user.status_change == %w[registered active])
 
-    if params[:activate] && @user.missing_authentication_method?
+    if activated_account && @user.missing_authentication_method?
       flash[:error] = I18n.t("user.error_status_change_failed",
                              errors: I18n.t(:notice_user_missing_authentication_method))
     elsif @user.save
       flash[:notice] = I18n.t(:notice_successful_update)
-      if was_activated
+      if should_deliver_activation_mail
         UserMailer.account_activated(@user).deliver_later
       end
     else