https://www.bountysource.com/issues/75392602-move-to-laravel-6

Laravel 6 has been released and is a LTS release (https://laravel.com/docs/6.x/releases#laravel-6). As such, October should look at moving from 5.5 to 6. This issue will contain discussions relevant to that change and related issues.

Upgrade Guides:

• [x] 5.5 -> 5.6: https://laravel.com/docs/5.6/upgrade
• [x] 5.6 -> 5.7: https://laravel.com/docs/5.7/upgrade
• [x] 5.7 -> 5.8: https://laravel.com/docs/5.8/upgrade
• [x] 5.8 -> 6.x: https://laravel.com/docs/6.x/upgrade

Related Issues: (so far)

• [x] https://github.com/octobercms/october/issues/4182 (No longer necessary)
• [x] https://github.com/owncloud/core/issues/13052 & https://www.happyassassin.net/2014/12/29/adventures-in-php-web-asset-minimization/ (Change from JSMin to JSqueeze) - (implemented in https://github.com/octobercms/october/pull/4893/commits/627c0aa6431ad67c6575851b85630856eb5448d8)
• [x] #4797 will be moving to a fork of Assetic maintained by the core October CMS team, also will need to ensure that we use wikimedia's fork of LessPHP which will require PHP 7.2.9 (Fixed by https://github.com/octobercms/library/pull/443)
• [x] https://github.com/rainlab/builder-plugin/issues/212#issuecomment-489566704 (Upgrade doctrine/dbal) (Fixed by https://github.com/octobercms/library/pull/443)
• [x] https://github.com/octobercms/october/pull/4280 (Update autoloading) (Implemented in https://github.com/octobercms/october/commit/e099b7bdeea9f9619196cb288da9603aae016ea7)
• [x] https://github.com/octobercms/october/pull/3051 (Laravel Dusk replacing Selenium) (Fixed by https://github.com/octobercms/october/pull/4919)
• [x] https://github.com/octobercms/october/issues/3532 (Update PHPUnit) (Fixed by https://github.com/octobercms/library/pull/443)
• [x] https://github.com/octobercms/october/issues/4649 (HasOneThrough relationship) (Implemented in https://github.com/octobercms/library/commit/90718d8c6def5c86fd9479e031f38fb8c5534d29, unit tests https://github.com/octobercms/october/commit/26944a5f68ae34723d9ecfdeac8be4bd799950d4)
• [x] https://github.com/octobercms/october/issues/3893 (SameSite cookie not working) (Fixed by build 462)
• [x] https://github.com/octobercms/october/issues/3227 (Bring October's Auth system more in line with Laravel's) (This will be investigated for inclusion at a later stage - at the moment, our authentication process is largely incompatible with Laravel's Auth system)
• [x] https://github.com/octobercms/october/issues/4184 (Update Carbon to Carbon2)
• [x] https://github.com/octobercms/library/commit/c8e2740d974a4409f9990d64f19ef493acf7c0e6 (Revisit cookie serialization and encryption serialization in general)
• [x] https://github.com/octobercms/library/pull/443 (Unit testing upgrading) (Merged)
• [x] L6 also includes a switch to the Ignition error page handler (https://github.com/facade/ignition), we should look into integrating that into October (We will not be including this in October at this stage.)
• [ ] Support added back for serializable closures, also check if route caching works with closures (https://github.com/octobercms/docs/issues/425)
• [x] Update marketplace's list of pre-installed composer dependencies: https://github.com/octobercms/october/issues/2831
• [x] October's Translation service doesn't match Laravel's https://github.com/octobercms/october/issues/5092, fixed by https://github.com/octobercms/library/commit/b8e400b6a3a076a9a70dba42631bfe13bff30cd3

Breaking changes: (so far)

• [x] storage/framework/cache/data directory needs to be added and !data/ added to the .gitignore file under storage/framework/cache (Fixed by https://github.com/octobercms/october/pull/4893/commits/25511bfd34e338bd95f2b4d1721d2ca50d8a551d)
• Cms\Classes\CmsObjectCollection->where() method signature changed
• [x] Require PHP 7.2 (Fixed by https://github.com/octobercms/library/pull/443)
• [x] Require PHP Unit 8.0 (unit tests will need to have return type hints added) - also remove https://github.com/octobercms/october/commit/72f85ebc558a8e6fe514f6496f5393e535bac41b when updating (Fixed by https://github.com/octobercms/library/pull/443)
• [x] Cache TTL has been changed from minutes to seconds when using integers, recommend using datetime objects instead
• [x] ~~May need to swap https://github.com/meyfa/phpunit-assert-gd for https://github.com/lupka/phpunit-compare-images as assertGD doesn't support PHPUnit 7.0~~ (No longer required, phpunit-assert-gd supports PHPUnit 8 now) (Fixed by https://github.com/meyfa/phpunit-assert-gd/pull/2)
• [x] setUp() and tearDown() methods in unit tests require adding : void as a return type hint to their definitions. (Fixed by https://github.com/octobercms/library/pull/443)
• [x] If you're utilizing the core unit tests you will need to grab the latest copies of the base unit tests from octobercms/october on GitHub and drop them into your project
• [x] Carbon will be updated from v1 to v2, see https://carbon.nesbot.com/docs/#api-carbon-2 (Still need to go through and upgrade in core)
• [x] Sparkpost & Mandrill mail drivers removed from core Laravel, we should probably add them back to October (i.e. revert https://github.com/laravel/framework/commit/e2461f19c3b951f7cbb4b424601cad1f6553774a#diff-c1d5bf1c77457840314f00f3837a2b2a in octobercms/library) (Implemented in https://github.com/octobercms/library/commit/c8e34ea17579b5c8a7a4f9d9414d713425e6f30c)
• [x] The Input facade has been removed as it was mostly a mirror of the Request facade, we need to add it back in (https://laravel.com/docs/6.x/upgrade#the-input-facade) (Fixed by https://github.com/octobercms/library/pull/443)
• [x] The default redis client has changed from predis to phpredis. Configuration change may be required by users wishing to retain predis, or potentially we need to dynamically set the configuration for people (by adding a client config value defaulting to phpredis and doing Config::set() if the value isn't detected). See more here: https://laravel.com/docs/6.x/upgrade#redis-default-client (Fixed by https://github.com/octobercms/library/commit/4aeaf54d7e3d12a916a3e096cdbf730fe2aee992, https://github.com/octobercms/october/compare/0394494fbe43...a2966da395bb)
• [x] Rackspace storage support was removed. Potentially needs to be re-added? (Re-added in https://github.com/octobercms/library/commit/3ee82fd1af518fac829d780fcedf2cbf723efff0)
• [x] email validation rule changed internal behaviour to use a broken version of RFC validation instead of PHP's built in validation, need to change it back. See https://github.com/octobercms/october/issues/5070
• [x] trans() and transChoice() methods have been removed from the Translation service, fixed by https://github.com/octobercms/library/commit/a364d6455698b4786efc6870cf097a8677b2dccc

Other tasks:

• [x] Integrate old helpers (https://github.com/laravel/helpers/blob/master/src/helpers.php) into Rain library. (Implemented in https://github.com/octobercms/library/pull/456/commits/af29bbfc32230140d4deac1a76b5b81d38f401f1)
• [x] Update the Unit Testing documentation in the docs repo and https://github.com/octobercms/october/tree/wip/laravel-6/tests#plugin-testing
• [x] Confirm Selenium tests in tests/functional directory still work, update README if necessary. (Replaced with Dusk testing: https://github.com/octobercms/october/pull/4919)
• [x] [Low priority] Add Selenium tests to GitHub Actions workflow.
• [ ] Go through all of the documentation under octobercms/docs that originally mirrored the Laravel docs and update it to reflect the latest changes to the Laravel docs.
• [x] Update Validator to include latest rules. (fixed by https://github.com/octobercms/october/commit/9911c6b5817088a99ac65d9f2ac76346402e1d47)
• [x] Update Laravel Tinker to 2.0 to improve compatibility of dependencies https://github.com/octobercms/library/commit/6fae9cd2baed001f9aa69415f2f130fc104eb573

Known issues:

• [x] Signed URLs do not seem to work. (fixed by https://github.com/octobercms/library/pull/456/commits/c258e666b9c66174e773a57317764209665f2703)
• [x] php artisan cache:clear removes the required storage/framework/cache/data folder.

This is to discuss revenue generation ideas for the core development team (@LukeTowers, @daftspunk , @alekseybobkov) in order to keep the project going strong.

Each idea should be a separate comment and should be voted / shown support for with emoji reactions. Ideas and discussion appreciated. NOTE: Please only show support for ideas that you would pay money for / signup for.

Current Revenue Streams:

Marketplace Gratuity: 30% of Marketplace sales goes to maintaining the marketplace Partner Program: Paid promotional slots for businesses that deal with OctoberCMS Private Plugins & Themes: Private plugins & themes hosted on the marketplace Luke's Patreon: Patreon account to support the me directly Luke's GitHub Sponsors GitHub sponsors program to support me directly One time & Recurring donations: One time & recurring donations made on the OctoberCMS website Feature Sponsoring & Bountysource: One-off improvements to the platform and plugins that are funded by the community. See https://www.bountysource.com/teams/rainlab. OpenCollective: See https://opencollective.com/octobercms

This PR adds the new Priority Hints API, Preload API and async to the October CMS AJAX injected code and adds the new Priority Hints API to the loaded assets in the head section.

This is related to the github issues: https://github.com/octobercms/october/issues/4277 and https://github.com/octobercms/october/issues/4030

Explanation

As performance becomes increasingly important, it's exciting to see browsers implement new features which give developers more control over resource loading. Resource Hints such as rel=preload and rel=preconnect give developers more control over resource loading and connections to cross-origin servers, respectively. Client Hints expose details of a user's device and preferences that developers can use to improve performance in nuanced ways. Continuing in this vein, a new api feature known as Priority Hints.

When a browser downloads a resource, the resource is assigned a priority. By default, priorities depend on the type of resource (e.g., script, image, etc.), and the location of the resource reference in the document. For example in Chrome, CSS loaded in typical fashion via the <link> element in the <head> will be assigned a priority of highest, as it blocks rendering. Images in the viewport may be assigned a priority of high, whereas images outside the viewport may be assigned a priority of low. A <script> loaded at the end of the document may receive a priority assignment of medium or low, but this can be influenced by defer and async.

Priority Hints API

The API is rather simple and was created by Google. It features an attribute called: importance which you can assign either a high, low or auto value to it.

• high - The developer considers the resource as being high priority.
• low - The developer considers the resource as being low priority.
• auto - The developer does not indicate a preference. This also serves as the attribute's invalid value default and missing value default.

In this PR I have given the important assets in the <head> section a importance="high" and the October AJAX code a importance="low". This is because the important assets are needed to render the web page and the assets for October CMS AJAX code can be loaded after the render of the web page. This increases the load performance of the web page in October CMS.

Useful Links

Priority Hints API Spec: https://wicg.github.io/priority-hints/

• OctoberCMS Build: 446
• PHP Version: 7.2.10
• Database Engine: Mysql
• Plugins Installed: October Demo, RedirectToHTTPS

Description:

Newly created administrators have trouble accessing pages in the backend.

Steps To Reproduce:

• Created new administrator from CMS as a Developer with Super User.
• Login with new administrator account.
• Browse to CMS -> Pages
• Clicking on a page name does absolutely nothing.
• Checking any checkbox next to page names (ones for multiple deleting) fixes the problem.
• Inspecting the page shows following errors: Uncaught TypeError: Cannot read property 'setActiveItem' of undefined jquery.min.js?v446:2 jQuery.Deferred exception: Cannot read property 'setActiveItem' of undefined TypeError: Cannot read property 'setActiveItem' of undefined Uncaught TypeError: Cannot read property 'goTo' of undefined

According to the W3c there are two types of checkboxes these are:

1. (Two State) Checkbox

Here we have a single checkbox example:

The doc's can be found here: https://octobercms.com/docs/backend/forms#field-checkbox

A working example can be found here: https://octobercms.com/docs/ui/checkbox

2. (Tri State) Checkbox List

Here we have a checkbox list example:

The doc's can be found here: https://octobercms.com/docs/backend/forms#field-checkboxlist

A working example can be found here: DOES NOT EXIST!

Problems with October's Checkbox List

The problem is that October CMS for it's Checkbox List is actually using a (Two State) and not a (Tri State) method I tricked you in the above example!

Let's now show you a proper (Tri State) method:

Did you spot the difference?

Let me explain, let's say there are 50 checkbox's in the Checkbox list how long would it take your Users/Clients before they finished selecting all the checkbox's in the checkbox list? Even more important, how long would it take before they started to get annoyed?

A (Tri State) method allows your Users/Clients to be able to select all the checkbox's, de-select all the checkbox's and allow their custom selection.

Solutions

October CMS needs to do three things:

1. Add a working Checkbox list example to their doc's.

2. Change the Checkbox list from a (Two State) into a (Tri State) method.

3. Add WAI-ARIA to the checkbox and Checkbox list fields.

Adds support for WAI-ARIA to October's Tabs, I not tested this yet, but then code is pretty simple and I think I can't get this wrong (I hope).

Relates to github issue: https://github.com/octobercms/october/issues/4400

Summary of features this PR adds (for release notes)

1. Added WAI-ARIA to the layout templates files.
2. Added Focus-ring polyfill to allow better keyboard navigation and screen reader support.
3. Added WAI-ARIA to tabs and created keyboard arrow controls for tabs.
4. Added event.key polyfill to allow removal of deprecated event.keyCode, event.charCode and event.which.
5. Fixed all the whitespace, tabbing and indent issues with all the lang files.
6. Keyboard navigation now allows the following key actions: Tab, Up Arrow, Down Arrow, Left Arrow, Right Arrow, Home and End buttons.
7. Added keyboard navigation for tab panels.

Actual behavior

I'm trying to setup a new install of October on Ubuntu 16.04 using mysql (tried MariaDB also) and during the final install using the wizard when it is doing the "Create admin account" I get the following error:

SQLSTATE[HY000] [1045] Access denied for user 'root'@'localhost' (using password: NO) (SQL: select * from information_schema.tables where table_schema = database and table_name = migrations)

I'm guessing it's something I have configured wrong, but I haven't been able to figure it out.

• OctoberCMS Build: ### 458
• PHP Version: 7.3
• Database Engine: MySQL
• Plugins Installed:

Description:

Flickering on Media manager files. If you open Media manager folder with a lot of files and try to scroll down to the last you will see flickering, and you are unable to select any of the files. Something i noticed is that if you resize browser window it stops flickering and is working fine. You can see this issue bellow:

Steps To Reproduce:

Just open Media manager Create folder and upload many images Try to scroll down to the latest Flickering!

This is an updated PR to the old PR found here: https://github.com/octobercms/october/pull/3879

In this PR I have totally removed all the Middleware!

Instead we now have the following things happening:

1. Sign-in screen uninstalls any Service Worker and also completely clears any old cache which may contain old cookies!

• uninstall Service Worker is done by modules/backend/assets/js/auth/unistall-sw.js file

• completely clear any old cache and cookies done by this HTTP Header: Cache-Control: no-cache, no-store, must-revalidate

For more info see here: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control

2. Sign-out I have set the NEW Security HTTP Header 'Clear Site Data' to remove all Sensitive Data, to keep webmasters and admins more safe, when using "shared devices".

• add NEW Security HTTP Header 'Clear Site Data' by this HTTP Header: Clear-Site-Data: "cache", "cookies", "storage", "executionContexts"

For more info on the new Security Header 'Clear Site Data' you can see the spec found here: https://www.w3.org/TR/clear-site-data/ and https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Clear-Site-Data#Sign-out

This PR relates to the Github Issue found here: https://github.com/octobercms/october/issues/3707

Testing

I have tested this PR on a demo website and it seems to fix all the problems now. However there is one issue left. The Sign-in screen has the following HTTP Headers:

It would be nice not to have the same Cache Control Header being loaded twice!

@w20k Let me know your thoughts.

Expected behavior

The OctoberCMS backend works with the following Content-Security-Policy:

default-src 'none'; script-src 'self'; connect-src 'self'; img-src 'self'; style-src 'self';

Actual behavior

The OctoberCMS backend crashes because the code violates the previous Content-Security-Policy. Here is the error:

Uncaught Error: Error parsing the data-request-update attribute value. EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' data: connect.facebook.net sdk.accountkit.com www.google-analytics.com".
    at paramToObj (framework.js?v1:459)
    at n.fn.init.$.fn.request (framework.js?v1:426)
    at Function.$.request (framework.js?v1:437)
    at HTMLDocument.<anonymous> (backend:238)
    at j (jquery.min.js?v1:2)
    at Object.fireWith [as resolveWith] (jquery.min.js?v1:2)
    at Function.ready (jquery.min.js?v1:2)
    at HTMLDocument.I (jquery.min.js?v1:2)

The error is produced at exactly this line in assets/js/framework.js.

This error doesn't occur when including 'unsafe-eval' in the CSP header, like so:

default-src 'none'; script-src 'self' 'unsafe-eval'; connect-src 'self'; img-src 'self'; style-src 'self';

This error occurs because eval is used to parse arbitrary JSON data from the client, I presume. I don't understand the reasoning for using eval > stringify > parse, as I believe that simply parse should be enough, and that would fix this issue.

Reproduce steps

1. Create a fresh OctoberCMS install.
2. Put it behind an NGINX reverse proxy.
3. Add the following directive to the NGINX configuration:

   add_header Content-Security-Policy  "default-src 'none'; script-src 'self'; connect-src 'self'; img-src 'self'; style-src 'self';" always;
   

4. Navigate to https://my-site.test/backend, and log in

October build

v1.0.435

October CMS doesn't support the themes internationalization at the moment. I mean that you can't add more than one (default) language to the theme settings screens. It's an unsolvable issue for the development of the themes for the international market.

We at LOVATA just started to develop themes for our Shopaholic. And we plan to add a huge amount of themes to the marketplace in the near future. And we want to make themes using more easy for the non-English speaking users. Not only we faced this problem, please, look at this tweet.

If you have a model query like: ->where(...)->orWhere(...) the final SQL query looks like " ... and is not null and .... or .... ", but it should be " ... and is not null and ( ... or ... )".

This happened in version 3.1.28

Hi. I'm trying to add an object editor to my component/snippet:

Works great as a component. But when I try to add a code snippet to a static page and edit the options I get an error and I can't close the options screen.

CMS version: 2.2.34

Hello,

I post here to suggest a small QOL improvement, but as I create partials 50 times per day, it can become really cool to have, that's why I post here.

When you reference a partial like this :

{% partial 'myfolder/mypartial' %}

You already know that ctrl + click that partial will open it in a new tab, and it's really useful. But when the partial doesn't exist, it would be awesome to create it.

Probably not a big deal to implement and would save time to many people.

Best regards,