Merge branch 'master' into develop

VERSION

@@ -1 +1 @@
-1.35.0.1
+1.35.0.2

app/assets/javascripts/sitewide/marvinjs_editor.js

@@ -237,7 +237,9 @@ var MarvinJsEditorApi = (function() {
     enabled: function() {
       return ($('#MarvinJsModal').length > 0);
     },
-
+    isRemote: function() {
+      return marvinJsMode === 'remote';
+    },
     open: function(config) {
       if (!MarvinJsEditor.enabled()) {
         $('#MarvinJsPromoModal').modal('show');
@@ -322,21 +324,22 @@ $(document).on('click', '.gene-sequence-edit-button', function() {
 function initMarvinJs() {
   MarvinJsEditor = MarvinJsEditorApi();
 
-  let isRemote = $('#marvinjs-editor')[0].dataset.marvinjsMode === 'remote';
+  // MarvinJS is disabled, nothing to initialize
+  if (!MarvinJsEditor.enabled()) return;
 
-  if (MarvinJsEditor.enabled()) {
-    if (isRemote && typeof (ChemicalizeMarvinJs) === 'undefined') {
-      setTimeout(initMarvinJs, 100);
-      return;
-    }
-
-    if (isRemote) {
-      ChemicalizeMarvinJs.createEditor('#marvinjs-sketch').then(function(marvin) {
-        marvin.setDisplaySettings({ toolbars: 'reporting' });
-        marvinJsRemoteEditor = marvin;
-      });
-    }
+  // wait for remote MarvinJS to initialize
+  if (MarvinJsEditor.isRemote() && typeof (ChemicalizeMarvinJs) === 'undefined') {
+    setTimeout(initMarvinJs, 100);
+    return;
   }
+
+  if (MarvinJsEditor.isRemote()) {
+    ChemicalizeMarvinJs.createEditor('#marvinjs-sketch').then(function(marvin) {
+      marvin.setDisplaySettings({ toolbars: 'reporting' });
+      marvinJsRemoteEditor = marvin;
+    });
+  }
+
   MarvinJsEditor.initNewButton('.new-marvinjs-upload-button');
 }
 

app/assets/javascripts/users/login_disclaimer.js

@@ -14,6 +14,8 @@
   initDisclaimer('.log-in-button', '#new_user');
   initDisclaimer('.btn-okta', '#oktaForm');
   initDisclaimer('.btn-azure-ad', '.azureAdForm');
+  initDisclaimer('.btn-openid-connect', '#openidConnectForm');
+  initDisclaimer('.btn-saml', '#samlForm');
   initDisclaimer('.sign-up-button', '#sign-up-form');
   initDisclaimer('.forgot-password-submit', '#forgot-password-form');
   initDisclaimer('.invitation-submit', '#invitation-form');

app/assets/stylesheets/themes/scinote.scss

@@ -385,21 +385,11 @@ mark,.mark {
 .azure-sign-in-actions {
   margin-bottom: 10px;
   margin-top: 10px;
-
-  .btn-azure-ad {
-    background-color: $office-ms-word;
-    color: $color-white;
-  }
 }
 
 .okta-sign-in-actions {
   margin-bottom: 10px;
   margin-top: 10px;
-
-  .btn-okta {
-    background-color: #00297a;
-    color: $color-white;
-  }
 }
 
 .navbar-secondary {

app/javascript/vue/shared/content/table.vue

@@ -267,6 +267,16 @@ export default {
 
       this.$emit('update', this.element, false, callback);
     },
+    updateTableData() {
+      if (this.editingTable === false) return;
+      this.updatingTableData = true;
+
+      this.$nextTick(() => {
+        this.update(() => {
+          this.editingCell = false;
+        });
+      });
+    },
     loadTableData() {
       const container = this.$refs.hotTable;
       const data = JSON.parse(this.element.attributes.orderable.contents);
@@ -294,12 +304,19 @@ export default {
           }
         },
         afterChange: () => {
-          if (this.editingTable === false) return;
-          this.updatingTableData = true;
-
-          this.$nextTick(() => {
-            this.update(() => this.editingCell = false);
-          });
+          this.updateTableData();
+        },
+        afterRemoveRow: () => {
+          this.updateTableData();
+        },
+        afterRemoveCol: () => {
+          this.updateTableData();
+        },
+        afterCreateCol: () => {
+          this.updateTableData();
+        },
+        afterCreateRow: () => {
+          this.updateTableData();
         },
         beforeKeyDown: (e) => {
           if (e.keyCode === 27) { // esc

app/utilities/users_generator.rb

@@ -67,7 +67,7 @@ module UsersGenerator
 
   def generate_user_password
     require 'securerandom'
-    SecureRandom.hex(5)
+    SecureRandom.alphanumeric(Devise.password_length.max)
   end
 
   def get_user_initials(full_name)

app/views/users/shared/_azure_sign_in_links.html.erb

@@ -1,7 +1,7 @@
 <% ApplicationSettings.instance.values['azure_ad_apps'].select { |v| v['enable_sign_in'] }.each do |config| %>
   <div class="form-group">
     <%= form_tag user_customazureactivedirectory_omniauth_authorize_path(provider: config['provider_name']), method: :post, class: "azureAdForm" do %>
-      <%= submit_tag config['sign_in_label'] || t('devise.sessions.new.azure_ad_submit'), class: 'btn btn-primary' %>
+      <%= submit_tag config['sign_in_label'] || t('devise.sessions.new.azure_ad_submit'), class: 'btn btn-primary btn-azure-ad' %>
     <% end %>
   </div>
 <% end %>

app/views/users/shared/_links.html.erb

@@ -31,7 +31,7 @@
     <%- if sso_enabled? && okta_enabled? %>
       <div class="okta-sign-in-actions">
         <%= form_tag user_okta_omniauth_authorize_path, method: :post, id: 'oktaForm' do %>
-          <%= submit_tag t('devise.okta.sign_in_label'), class: 'btn btn-primary' %>
+          <%= submit_tag t('devise.okta.sign_in_label'), class: 'btn btn-primary btn-okta' %>
         <% end %>
       </div>
     <% end %>
@@ -50,16 +50,16 @@
 
     <%- if sso_enabled? && openid_connect_enabled? %>
       <div class="azure-sign-in-actions">
-        <%= form_tag user_openid_connect_omniauth_authorize_path, method: :post do %>
-          <%= submit_tag t('devise.sessions.new.openid_connect_submit'), class: 'btn btn-primary' %>
+        <%= form_tag user_openid_connect_omniauth_authorize_path, method: :post, id: 'openidConnectForm' do %>
+          <%= submit_tag t('devise.sessions.new.openid_connect_submit'), class: 'btn btn-primary btn-openid-connect' %>
         <% end %>
       </div>
     <% end %>
 
     <% if sso_enabled? && saml_enabled? %>
       <div class="azure-sign-in-actions">
-        <%= form_tag user_saml_omniauth_authorize_path, method: :post do %>
-          <%= submit_tag t('devise.sessions.new.saml_submit'), class: 'btn btn-primary' %>
+        <%= form_tag user_saml_omniauth_authorize_path, method: :post, id: 'samlForm' do %>
+          <%= submit_tag t('devise.sessions.new.saml_submit'), class: 'btn btn-primary btn-saml' %>
         <% end %>
       </div>
     <% end %>

config/application.rb

@@ -53,6 +53,8 @@ module Scinote
 
     config.action_dispatch.cookies_serializer = :hybrid
 
+    config.action_view.preload_links_header = false if ENV['RAILS_NO_PRELOAD_LINKS_HEADER'] == 'true'
+
     # Max uploaded file size in MB
     config.x.file_max_size_mb = (ENV['FILE_MAX_SIZE_MB'] || 50).to_i
 
@@ -62,6 +64,8 @@ module Scinote
 
     config.x.custom_sanitizer_config = nil
 
+    config.x.no_external_csp_exceptions = ENV['SCINOTE_NO_EXT_CSP_EXCEPTIONS'] == 'true'
+
     # Logging
     config.log_formatter = proc do |severity, datetime, progname, msg|
       "[#{datetime}] #{severity}: #{msg}\n"

config/initializers/extends.rb

@@ -595,21 +595,31 @@ class Extends
     'FluicsLabelTemplate' => 'Fluics'
   }
 
-  EXTERNAL_SCRIPT_SERVICES = %w(
-    https://marvinjs.chemicalize.com/
-    www.recaptcha.net/
-    www.gstatic.com/recaptcha/
-  )
+  EXTERNAL_SCRIPT_SERVICES =
+    if Rails.application.config.x.no_external_csp_exceptions
+      []
+    else
+      %w(
+        https://marvinjs.chemicalize.com/
+        www.recaptcha.net/
+        www.gstatic.com/recaptcha/
+      )
+    end
 
-  EXTERNAL_CONNECT_SERVICES = %w(
-    https://www.protocols.io/
-    http://127.0.0.1:9100/
-    newrelic.com
-    *.newrelic.com
-    *.nr-data.net
-    extras.scinote.net
-    https://www.scinote.net
-  )
+  EXTERNAL_CONNECT_SERVICES =
+    if Rails.application.config.x.no_external_csp_exceptions
+      %w(http://127.0.0.1:9100/)
+    else
+      %w(
+        https://www.protocols.io/
+        http://127.0.0.1:9100/
+        newrelic.com
+        *.newrelic.com
+        *.nr-data.net
+        extras.scinote.net
+        https://www.scinote.net
+      )
+    end
 
   if Constants::ASSET_SYNC_URL && EXTERNAL_CONNECT_SERVICES.exclude?(Constants::ASSET_SYNC_URL)
     asset_sync_url = URI.parse(Constants::ASSET_SYNC_URL)