Strip tags to sanitize input in User profile and in Tags & Comments. I had a mail from etat.ge.ch audit firm that reports these as XSS injection risk in their automated exam.

Is there an updated version of the included image viewer? It works great with a mouse and keyboard, but on my touch screen I can't pan or pinch zoom at all.

Pawtucket Master branch is presenting this error when installing from Master on MacOS Monterey using Homebrew: Fatal error: Composer detected issues in your platform: Your Composer dependencies require a PHP version ">= 7.4.0". You are running 7.3.33. in /path/to/pawtucket/vendor/composer/platform_check.php on line 24

If I run composer install the issue resolves.

The release notes say it should run in PHP 7.3

Providence does not cause this error

After more testing, it looks like the carousel on the object Detail page is initialized incorrectly and as a result will only work when there are exactly 1 or 2 representations attached to an object. Any more than that and it is necessary to click through all of the slides before the carousel is properly initialized.

Note 1: The TileViewer is not affected by this bug. After clicking to enlarge, the little links at the bottom of the viewer will advance through the images as expected.

Note 2: The Gallery carousel is not affected by this bug. That one works as expected.

Note 3: Much of the carousel code lives in https://github.com/collectiveaccess/pawtucket2/blob/master/themes/default/views/bundles/representation_viewer_html.php

Note 4: The carousel is invoked by https://github.com/collectiveaccess/pawtucket2/blob/855d52732ce55ec8498b5ee8a22d921d0ee8584b/themes/default/views/Details/ca_objects_default_html.php#L49

Steps to reproduce bug:

• Upload a media file containing an ampersand (&) in the name.
• First tested with the BinaryFile plugin. For example, John & Jane.pspimage
• Additional testing showed same result with JPG files when downloading through Pawtucket.

Expected result:

• Name should appear correctly in the media section.
• Upon clicking the Download link in Pawtucket, the original filename or a reasonable substitute should be provided.

Actual result:

• Name is correct in media section.
• Upon download, the provided filename is corrupted like John_&amp with incomplete name and no extension.

Workaround:

It would be necessary to change the filename prior to upload. I had attempted to add the Original filename field to the Object representation editor; it displays the name but will not save any changes.

We've copied things to a new server, updated from 1.7.9 to 1.7.13 (db schema 158), and created a new theme.

When use_identifiers_in_urls was set to 0 in the new theme, the URLs resolved correctly. When we changed the value to 1, entities without IDs no longer resolve and the URL encoding seems to not work. We did not have this issue in our past installation. I'm trying to track down where this is happening. Here are examples from the 2 servers old and new. Old install: https://digitalarchives.library.newschool.edu/index.php/Detail/people/id%3A4079 New Install: https://dev-digital.archives.newschool.edu/index.php/Detail/entities/id%3A4079

if you manually replace the '%3A' with the deencoded ':', the URL resolves correctly.

using providence develop branch database, searching for any term in pawtucket, or clicking a collection hierarchy link for an object results in:

Cannot add or update a child row: a foreign key constraint fails (`providencedev`.`ca_search_log`, CONSTRAINT `fk_ca_search_log_user_id` FOREIGN KEY (`user_id`) REFERENCES `ca_users` (`user_id`)) in /usr/share/nginx/html/pawtucket/app/lib/Db/mysqli.php line 316:

Warning: join(): Invalid arguments passed in /usr/share/nginx/html/pawtucket/themes/default/views/system/fatal_error_html.php on line 52
In Db_mysqli->execute() in DbStatement line 151

Warning: join(): Invalid arguments passed in /usr/share/nginx/html/pawtucket/themes/default/views/system/fatal_error_html.php on line 52
At DbStatement->executeWithParamsAsArray() in Db line 261

Warning: join(): Invalid arguments passed in /usr/share/nginx/html/pawtucket/themes/default/views/system/fatal_error_html.php on line 52
At Db->query() in Searchlog line 58

Warning: join(): Invalid arguments passed in /usr/share/nginx/html/pawtucket/themes/default/views/system/fatal_error_html.php on line 52
At Searchlog->log() in SearchEngine line 373

Warning: join(): Invalid arguments passed in /usr/share/nginx/html/pawtucket/themes/default/views/system/fatal_error_html.php on line 52
At SearchEngine->doSearch() in CollectionSearch line 50

Warning: join(): Invalid arguments passed in /usr/share/nginx/html/pawtucket/themes/default/views/system/fatal_error_html.php on line 52
At CollectionSearch->search() in searchHelpers line 449

Warning: join(): Invalid arguments passed in /usr/share/nginx/html/pawtucket/themes/default/views/system/fatal_error_html.php on line 52
At caPuppySearch() in BaseMultiSearchController line 104

Warning: join(): Invalid arguments passed in /usr/share/nginx/html/pawtucket/themes/default/views/system/fatal_error_html.php on line 52
At BaseMultiSearchController->Index() in MultiSearchController line 59

Warning: join(): Invalid arguments passed in /usr/share/nginx/html/pawtucket/themes/default/views/system/fatal_error_html.php on line 52
At MultiSearchController->Index() in RequestDispatcher line 273

Warning: join(): Invalid arguments passed in /usr/share/nginx/html/pawtucket/themes/default/views/system/fatal_error_html.php on line 52
At RequestDispatcher->dispatch() in AppController line 113

Warning: join(): Invalid arguments passed in /usr/share/nginx/html/pawtucket/themes/default/views/system/fatal_error_html.php on line 52
At AppController->dispatch() in index line 124

When loading an object Details page in v1.7.15, the carousel slides are in ascending numerical order by representation ID. The detailRepresentationThumbnails on the other hand are in catalog order. This discrepancy causes unexpected behavior of the left and right arrow clicks.

This is a continuation of problems described in #38.

When an object has several representations, scrolling through the images on the Detail page doesn't work. After loading or reloading the page, clicking any thumbnail other than the first one will advance to the wrong image.

After clicking the "Share" link on a Details page and completing the email form, Pawtucket generates a multipart message including what appears to be a malformed thumbnail attachment. The payload begins with:

Content-Type: application/octet-stream
Content-Transfer-Encoding: base64
Content-Disposition: attachment

After that, my email client creates a generic filename with no extension. I had to open this in a text editor to find out that it was supposed to be an image. So, this is taking up space in the message and doing nothing else.

MiradorJS causes the disabled grid, list, map, timeline buttons in the browse view to be non-clickable. From assets/mirador/css/mirador-combined.css:3215

.disabled {
  opacity: 0.5;
  pointer-events: none;
}

This is because of the pointer-events: none; setting.

I made a dirty fix for this in the default theme. Feedback welcome.

Bumps dompdf/dompdf from 2.0.0 to 2.0.1.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Seeing this several times per day:

PHP Warning: join(): Invalid arguments passed in themes/default/views/system/fatal_error_html.php on line 52

for reference...

https://github.com/collectiveaccess/pawtucket2/blob/855d52732ce55ec8498b5ee8a22d921d0ee8584b/themes/default/views/system/fatal_error_html.php#L52

I just got my Pawtucket site set up and connected to Providence for the first time.

While surfing the Pawtucket features, I logged in using the default credentials admin:h3r1tag3

I then went to the profile page and attempted to reset my password. I used a random password generator and pasted this new password into both fields, exactly:

R=ZL["e\v^ys";5K

I am now unable to login using either password and effectively locked out of both websites. This seems to represent a major bug in the Collective Access password I/O. At this time I do not have any reason to believe it represents a security issue.

Attempting to browse Ca_Object_lots will throw an error: "Object_lots: Not unique table/alias: 'ca_objects' in /...."

Unless the SQL is modified (in themeHelpers.php) adding "as ca_objectsx":

$vs_sql = "SELECT DISTINCT ca_object_representations.media, {$vs_table}.{$vs_pk} FROM {$vs_table} INNER JOIN {$vs_linking_table} ON {$vs_linking_table}.{$vs_pk} = {$vs_table}.{$vs_pk} INNER JOIN ca_objects as ca_objectsx ON ca_objects.object_id = {$vs_linking_table}.object_id INNER JOIN ca_objects_x_object_representations ON ca_objects_x_object_representations.object_id = ca_objects.object_id INNER JOIN ca_object_representations ON ca_object_representations.representation_id = ca_objects_x_object_representations.representation_id WHERE ca_objects_x_object_representations.is_primary = 1 {$vs_access_wheres} {$vs_rel_type_where} {$vs_type_where} {$vs_id_sql}";

And changing $va_access_wheres to: $vs_access_wheres = " AND ca_objectsx.access IN (".join(",", $pa_access_values).") AND ca_object_representations.access IN (".join(",", $pa_access_values).")";