Bumped up packages:
* glob
* globals
* jest
* @quasar/app-webpack
Yarn resolutions added
- `serialize-javascript: ^7.0.3` — fixes high-severity RCE vulnerability
via RegExp.flags/Date.toISOString() (CVE in terser-webpack-plugin and
@quasar/ssr-helpers paths)
- `**/postcss-svgo/svgo: ^4.0.1` — fixes high-severity Billion Laughs
DoS (XML entity expansion) in cssnano's SVG optimization pipeline
- `dot-object/minimatch: ^3.1.2` — fixes high-severity ReDoS in
dot-object's glob dependency
- `**/flatted: 3.4.0` — fixes high-severity unbounded recursion DoS
in eslint and eslint-webpack-plugin's caching layer
What remains (30 vulnerabilities — all upstream-blocked)
The remaining vulnerabilities are entirely confined to dev-only
tooling and cannot be fixed without upstream releases:
- minimatch ReDoS across jest, @vue/test-utils, jest-serializer-vue,
@quasar/app-webpack, @quasar/quasar-app-extension-testing-unit-jest
- ajv ReDoS across eslint, eslint-webpack-plugin, @quasar/app-webpack
- webpack SSRF (buildHttp feature, not used in this project)
- qs DoS in webpack-dev-server's express (local dev only)
- esbuild dev server CORS issue (local dev only)
- vue-template-compiler XSS (no patch available upstream)
- tmp symlink issue, @tootallnate/once control flow (test tooling only)
Change-Id: I72f34757538f97bb3495a57d7f0263df58102f1e
(cherry picked from commit 1ebe3c0683)
Update axios to version 1.13.5 to fix a
denial‑of‑service issue in mergeConfig when
using malicious config object.
Change-Id: I4c1d2b3de42d7ab854ffaaee07e30fcb98d4cadc
(cherry picked from commit d62d29bfc1)
- force @isaacs/brace-expansion 5.0.1 (patches minimatch/glob issue)
- force qs 6.14.1 (patches express/body-parser issue from quasar tooling)
- force tar 7.5.7 (patches node-gyp/tar issue pulled via npm)
- note: npm itself has no patch plus the dep was not used so we
removed it.
NGCP-Flow: mr11.5
Change-Id: I9acd8e3c992d0678b39ca4f1722df5a2ce8f225c
- Keep callNumberInput getter returning full input for display purposes
- Use callNumberNormalized getter to strip domain before making calls
- Add callNumberNormalized to component's mapped getters
- Update startCall validation to use normalized number
Change-Id: I4172a4f426bf7f827e3ff717a901b8a64f4264d1
(cherry picked from commit afd3e09d55)
Bump axios from previous version to 1.13.1 for security and stability improvements
Change-Id: I3855f02d71837f0b6c7e86590f6b8e5ab16d2cb4
(cherry picked from commit 3a6f992f4a)
Remove stylus library as it has a malware
and it is not used in the repo.
We are not backporting the trunk commit
as currently the two branches have huge
differences with regards of libs versions.
NGCP-Flow: mr11.5
Change-Id: Iad196ce9d02e80a5775a1e4f3138e554b1a36d37
After backporting dependencies
upgrade with commits:
- d2ff287a63
- c189b98ad2
we were left with two high
vulnerabilities. We are
resolving those with this commit
NGCP-Flow: mr11.5
Change-Id: I15cc6c23643e289fbab0d18c6d426fe5b6ad112a
Resolved 21 out of 22 vulnerabilities (1 Low, 6 Moderate, 15 High).
Only vulnerability left is a moderate one from "vue-template-compiler",
a dependency of @quasar/quasar-app-extension-testing-unit-jest.
Tried the yarn resolution method too, however the version
needed to resolve the vulnerability is not compatible
with our current setup.
Change-Id: I5477c791542196d14dcb6b809c76c4981c8a0973
(cherry picked from commit 09f639c935)
To clean up a bit the situation we upgrade all possible
dependencies to resolve vulnerabilities alerts and
adapt the code where necessary.
* Started with 89 vulnerabilities.
Severity: 13 Low, 44 Moderate,32 High
* Result: 1 vulnerability.
Severity: 1 Moderate
Change-Id: Ic0d9f1aa7c05ea5cb01980e8e110260b4f5dc534
(cherry picked from commit 3d0180e9e6)
request after creating new mapping
When a PBX admin creates a CF for a Seat,
the endpoint (mr11.5x) automatically assigns
the PBX admin id to the destination even
if we pass the desired subscriberId in the
payload. For this reason this commit changes
the GET request params to name only.
NGCP-Flow: mr11.5
Change-Id: I1e2d3520a1d5441997dd519bb5daed29d13e3362
This commit fixes the following bugs:
* On refresh The PBX Seat Page crashes because the
seat id in the state goes back to null.
* PBX Seats and Groups pages' reactivity is not
working, in fact the components are not refreshed
upon manually changing the group or seat id in the URL.
* When user changes a destination that belonged
to admin user the app was getting stuck in an
infinite loop now we show the permission error.
* When user deletes a CF previously set by the admin,
or a mapping containing the above, the app was crashing.
We now delete the mapping and show a warning informing
the user if the associated destination set belongs
to admin.
* When seat user creates a new CF all CF previously
created by admin were disappearing because only
destinations filtered by csc users were retrieved
after the creation fo a new mapping instead of all
the available destinations.
* Time set created in admin were visualised as "...".
We now show the string "Custom time set" and show
a formatted summary of the details on click.
* Not all timesets were shown in call forward page
because of the missing parameter "all: true" in
the getList config. getList or pagination in csc
needs proper reviewing.
Change-Id: I06faa0a1fd0db003cb7ed81328147897386830ff
(cherry picked from commit 12043c549d)
When a CSC-UI User reloads the site the logo disappears, the problem was fixed by removing the function forwardHome.
NGCP-Flow: mr11.5
Change-Id: I976135461bfb562acfa662f978207148492c5815
Our tests have caught a weird behaviour for the endpoint
/cfdestinationsets v1 (mr11.5). The endpoint returns
an empty body after creating a new destination set.
This has been fixed by the backend team for versions
mr12.5 onward. To fix the problem in mr11.5 we add
an extra GET request to retrieve the new destination
set, before patching the mapping with the updated info.
NGCP-Flow: mr11.5
Change-Id: I3b42ce6682d4b51adea17e6d6bf7a0dd3cbb7860
The backend has been amended so that when a call
is recorded on both sides (caller and callee),
if one of the two sides deletes the recording,
the item is only removed from their view and the other
party can still see the recording. To achieve this we
add a param subscriber_id into the delete request.
As well this commit fixes the pop-up appearing to confirm
the user wants to proceed with deletion. The pop-up
was appearing without title and message, now both
are shown.
Change-Id: I7808fd3fad819e3e194448d16e882502f0a29bc6
(cherry picked from commit c64a0620c4)
Added two announcements: Temp/Greet Greeting in the voicebox section
Change-Id: I6026136eace78ef9d5bbdb27d99ad102ab0ee40d
(cherry picked from commit aff80a1e1f)
sip username is created removing whitespaces and special chars from
the name input. This logic was handled by a lodash method. This commit
replaces the mentioned method with a custom function that mirrors the
logic we use in ngcp-admin to handle the pbx group creation.
The new method is less aggressive in fact it allows the use of
underscores and doesn't dash numbers. As part of the change we also
expose sip username as read-only field in the edit pbxGroupDetails
page.
Change-Id: I086b3a7011e47d8f542ac92f42bd923c38630331
(cherry picked from commit ccf2b82831)
The files were not updates since long time.
Now they are in line with the english version, but still not traslated
Change-Id: I0ff78c1a8576ab2ee5e50a6553be1da7b86c0dee
(cherry picked from commit 5bd459cede)
Debora Crescenzo
nidrissi-zouggari
Giancarlo Errigo Mattos
Nico Schedel
Marco Capetta
Hugo Zigha
Rene Krenn
Sipwise Jenkins Builder