Rapido issueshttps://framagit.org/InfoLibre/rapido/-/issues2023-02-21T22:01:18Zhttps://framagit.org/InfoLibre/rapido/-/issues/168Left menu: no default langage when lang/xxx.json doesn't exist and when one s...2023-02-21T22:01:18ZInfoLibredavid.vantyghem@laposte.netLeft menu: no default langage when lang/xxx.json doesn't exist and when one start RapidoWhen starting Rapido for the first time, or when reloading the page, the left menu isn't translated if lang/xxx.json file doesn't exist.
TODO: set and use english as a default langage in these two cases.
![image](/uploads/dd61dc319d977...When starting Rapido for the first time, or when reloading the page, the left menu isn't translated if lang/xxx.json file doesn't exist.
TODO: set and use english as a default langage in these two cases.
![image](/uploads/dd61dc319d977cfeaed524922255fde3/image.png)https://framagit.org/InfoLibre/rapido/-/issues/167Archive with same id than Home page can't be deleted2022-01-15T22:30:02ZInfoLibredavid.vantyghem@laposte.netArchive with same id than Home page can't be deletedArchive id is compared with Homepage id before delete it.
**TODO**: don't compare Homepage id with Archive id but with id of page before being archived.
![Capture_d_écran_du_2022-01-15_23-26-41](/uploads/cb4749b3fc0939fb24fc97ec74eed75...Archive id is compared with Homepage id before delete it.
**TODO**: don't compare Homepage id with Archive id but with id of page before being archived.
![Capture_d_écran_du_2022-01-15_23-26-41](/uploads/cb4749b3fc0939fb24fc97ec74eed75b/Capture_d_écran_du_2022-01-15_23-26-41.png)https://framagit.org/InfoLibre/rapido/-/issues/166Verify security of token and passwords2022-01-29T14:36:13ZInfoLibredavid.vantyghem@laposte.netVerify security of token and passwords**TODO 1**: verify that we always use token when it is necessary and in a right way, to prevent cross-site request forgery (CSRF) and that it is enough sufficient.
See https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cr...**TODO 1**: verify that we always use token when it is necessary and in a right way, to prevent cross-site request forgery (CSRF) and that it is enough sufficient.
See https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.md
In addition to the use of a token, should we ask for a password or should we ask a confirmation by email, for important actions? (delete user/page/content, change password/email address)
**TODO 2**: verify password and add mechanisms to help user to choose a good password.
See https://cloud.google.com/solutions/modern-password-security-for-system-designers.pdf, https://cloud.google.com/solutions/modern-password-security-for-users.pdf and https://www.ssi.gouv.fr/uploads/2021/10/anssi-guide-authentification_multifacteur_et_mots_de_passe.pdfhttps://framagit.org/InfoLibre/rapido/-/issues/161login and password reset: improve security2022-01-12T14:16:51ZInfoLibredavid.vantyghem@laposte.netlogin and password reset: improve securityIf user email box is hacked, pirate can ask for a password reset.
If user or admin password are stolen, accounts and data are compromised.
**TODO**: on Settings - System - General page, add check-boxes to activate one or these additiona...If user email box is hacked, pirate can ask for a password reset.
If user or admin password are stolen, accounts and data are compromised.
**TODO**: on Settings - System - General page, add check-boxes to activate one or these additional authentication systems: code sent to a second email address, code sent by SMS, FIDO2 cryptographic login credentials... One of them must be mandatory to log on accounts and to ask for a password reset.https://framagit.org/InfoLibre/rapido/-/issues/159Deleted menus in navigation bar doesn't disappear immediatly2022-01-07T22:22:46ZInfoLibredavid.vantyghem@laposte.netDeleted menus in navigation bar doesn't disappear immediatlyWhen one deletes all menus in navigation bar, saves and after, quits the edit mode, the deleted menus still appear. One must reload the page in the web navigator to see them disappear.When one deletes all menus in navigation bar, saves and after, quits the edit mode, the deleted menus still appear. One must reload the page in the web navigator to see them disappear.https://framagit.org/InfoLibre/rapido/-/issues/157Manage Contact forms like Contents2022-01-30T10:56:19ZInfoLibredavid.vantyghem@laposte.netManage Contact forms like ContentsContents and Contact forms are both pages contents. So, they should be managed in the same way, if possible.
**TODO 1**:
In database, in table **page_content**:
- Remove column **access level** if itsn't used.
- Remove **json_settings*...Contents and Contact forms are both pages contents. So, they should be managed in the same way, if possible.
**TODO 1**:
In database, in table **page_content**:
- Remove column **access level** if itsn't used.
- Remove **json_settings** column and use **content_id** column with Contact forms like with Contents. Do not use anymore **0** for each Contact form but use a **content_id** corresponding to **id** in **contactform** table. WARNING: **content_id** will not be unique.
- As **content_id** will not be unique anymore, use it in code with **extension** column (better to rename it?) to filter **Contact forms** and **Contents**. Use values like **content-form** and **content**, or **1** and **2** or whatever is better. See https://framagit.org/InfoLibre/rapido/-/issues/132
![Capture_d_écran_du_2022-01-06_17-37-27](/uploads/ded6d22c9b9c6b0166bca6277f8ef289/Capture_d_écran_du_2022-01-06_17-37-27.png)
Adapt the code.
**TODO 2**: add the same security mecanism in **Settings - Features** than in **Settings - Files** -> a Contact form can't be deleted as long as it is used in a page. See https://framagit.org/InfoLibre/rapido/-/issues/156https://framagit.org/InfoLibre/rapido/-/issues/156Menu Settings: a page without content disappears2022-01-06T17:28:35ZInfoLibredavid.vantyghem@laposte.netMenu Settings: a page without content disappearsHow to reproduce:
- Create a new page.
- Edit this page and add a new content.
- Save and quit Page edition.
- Go to menu **Settings - Contents** and delete this new content.
- Go to menu **Settings - Pages** and choose this new page. C...How to reproduce:
- Create a new page.
- Edit this page and add a new content.
- Save and quit Page edition.
- Go to menu **Settings - Contents** and delete this new content.
- Go to menu **Settings - Pages** and choose this new page. Click on **See this page button**.
-> the page can't be displayed (404 error).
**TODO 1**: a page without any content should be always displayed.
**TODO 2**: once TODO 1 is solved, add the same security mecanism in **Settings - Contents** than in **Settings - Files** -> a Content can't be deleted as long as it is used in a page.
![Capture_d_écran_du_2022-01-06_16-38-53](/uploads/aa1c0632de17ec2bc1c5c83040483e14/Capture_d_écran_du_2022-01-06_16-38-53.png)https://framagit.org/InfoLibre/rapido/-/issues/152Some success/error messages are not displayed2022-01-04T09:44:04ZInfoLibredavid.vantyghem@laposte.netSome success/error messages are not displayedAll Go success/error messages are not displayed by Vue.
**TODO**: solve it in Vue code.
Examples:
1) Error messages when uploading files:
![Capture_d_écran_du_2022-01-04_10-14-50](/uploads/666082d7be8bb1a3695882ec3e4f3bda/Capture_d_é...All Go success/error messages are not displayed by Vue.
**TODO**: solve it in Vue code.
Examples:
1) Error messages when uploading files:
![Capture_d_écran_du_2022-01-04_10-14-50](/uploads/666082d7be8bb1a3695882ec3e4f3bda/Capture_d_écran_du_2022-01-04_10-14-50.png)
![Capture_d_écran_du_2022-01-04_10-15-37](/uploads/5f5b8668f8c7800631e56abea0c7681b/Capture_d_écran_du_2022-01-04_10-15-37.png)https://framagit.org/InfoLibre/rapido/-/issues/149GDPR compliance and security of Go code2022-01-30T10:46:28ZInfoLibredavid.vantyghem@laposte.netGDPR compliance and security of Go code**TODO 1**: verify that all things that users/administrators must not do nor see are not prevented by Vue frontend but by backend API, using account id, token, access rights, ...
Examples:
- List of accounts displayed in Settings - Acco...**TODO 1**: verify that all things that users/administrators must not do nor see are not prevented by Vue frontend but by backend API, using account id, token, access rights, ...
Examples:
- List of accounts displayed in Settings - Account is filtered by Vue file, not by Go API. Go API send all accounts list even when logged in person is not administrator (and it's bad). See [client/src/components/admin/Settings/Users.vue](https://framagit.org/InfoLibre/rapido/-/blob/master/client/src/components/admin/Settings/Users.vue).
- In **Settings - Features - Forms**, admins should see all forms but they don't.
**Access rights:**
- User must only see/edit/archive/delete:
- Pages with **Public** edition rights.
- Pages with **Private** edition rights, but only if he's the creator OR one of the authors of the page.
- Pages without creator nor author (accounts deleted).
- User must only see/archive/edit/delete:
- Contents that are used in a page he can see/edit/archive/delete.
- Contents that are not used in a page.
- Administrators can see/edit/archive/delete all pages and all contents.
See [Users' and developers' manual](https://framagit.org/InfoLibre/rapido/-/blob/master/docs/Users'%20and%20developers'%20manual.odt).
**TODO 2**: Rapido must be GDPR compliant. See:
- https://ec.europa.eu/info/law/law-topic/data-protection/eu-data-protection-rules_en#library
- https://edpb.europa.eu/our-work-tools/documents/public-consultations/2019/guidelines-42019-article-25-data-protection_en
- https://lincnil.github.io/Guide-RGPD-du-developpeur/#Fiche_n%C2%B00%c2%a0:_D%C3%A9velopper_en_conformit%C3%A9_avec_le_RGPD
**TODO 3**: improve code security:
- https://owasp.org/www-project-secure-coding-practices-quick-reference-guide/migrated_content
- https://owasp.org/www-project-go-secure-coding-practices-guide/
- https://owasp.org/www-project-code-review-guide/
- ...https://framagit.org/InfoLibre/rapido/-/issues/148Delete unuseful column in table "menu"2022-01-14T08:09:11ZInfoLibredavid.vantyghem@laposte.netDelete unuseful column in table "menu"![Capture_d_écran_du_2021-12-31_08-26-33](/uploads/f4ed4521b31e68d1bdb088c5ae0e555e/Capture_d_écran_du_2021-12-31_08-26-33.png)
**TODO**: delete **name** column in **menu** table if it is not used nor useful.![Capture_d_écran_du_2021-12-31_08-26-33](/uploads/f4ed4521b31e68d1bdb088c5ae0e555e/Capture_d_écran_du_2021-12-31_08-26-33.png)
**TODO**: delete **name** column in **menu** table if it is not used nor useful.https://framagit.org/InfoLibre/rapido/-/issues/146Add an eye in forms field to see hidden passwords2021-12-20T06:48:28ZInfoLibredavid.vantyghem@laposte.netAdd an eye in forms field to see hidden passwords**TODO:** add an eye in password forms field, on which we can click to show hidden characters. See https://forkaweso.me/Fork-Awesome/icon/eye/ and https://forkaweso.me/Fork-Awesome/icon/eye-slash/.
![Capture_d_écran_du_2021-12-17_22-46-...**TODO:** add an eye in password forms field, on which we can click to show hidden characters. See https://forkaweso.me/Fork-Awesome/icon/eye/ and https://forkaweso.me/Fork-Awesome/icon/eye-slash/.
![Capture_d_écran_du_2021-12-17_22-46-50](/uploads/90c80796d97d7fd519745ceae36c448c/Capture_d_écran_du_2021-12-17_22-46-50.png)
Something like this:
![Capture_d_écran_du_2021-12-20_07-46-52](/uploads/baef6d35733c4b303a88ac96affe157c/Capture_d_écran_du_2021-12-20_07-46-52.png)https://framagit.org/InfoLibre/rapido/-/issues/145Contact form: text and fields are not aligned2021-12-30T17:12:09ZInfoLibredavid.vantyghem@laposte.netContact form: text and fields are not aligned![Capture_d_écran_du_2021-12-17_22-32-11](/uploads/445aac8deb12b73ca74b604e5f4119bf/Capture_d_écran_du_2021-12-17_22-32-11.png)
See https://framagit.org/InfoLibre/rapido/-/blob/master/client/src/components/global/ContactForm.vue
![Capt...![Capture_d_écran_du_2021-12-17_22-32-11](/uploads/445aac8deb12b73ca74b604e5f4119bf/Capture_d_écran_du_2021-12-17_22-32-11.png)
See https://framagit.org/InfoLibre/rapido/-/blob/master/client/src/components/global/ContactForm.vue
![Capture_d_écran_du_2021-12-19_11-16-19](/uploads/b6a3f664cb0a56c2933a08d353d667a8/Capture_d_écran_du_2021-12-19_11-16-19.png)https://framagit.org/InfoLibre/rapido/-/issues/142Menu Settings - System: parameters in General tab and in SMTP server tab are ...2021-12-16T21:47:52ZInfoLibredavid.vantyghem@laposte.netMenu Settings - System: parameters in General tab and in SMTP server tab are in the same formSettings - System : parameters in "General" tab and "SMTP server" tab are saved in the same time.
![Capture_d_écran_du_2021-12-16_22-00-06](/uploads/65c651a7897ee7ce1974245e18aa213e/Capture_d_écran_du_2021-12-16_22-00-06.png)
![Capture...Settings - System : parameters in "General" tab and "SMTP server" tab are saved in the same time.
![Capture_d_écran_du_2021-12-16_22-00-06](/uploads/65c651a7897ee7ce1974245e18aa213e/Capture_d_écran_du_2021-12-16_22-00-06.png)
![Capture_d_écran_du_2021-12-16_22-46-50](/uploads/2ae32337d316da7ab9dfbda501c0623d/Capture_d_écran_du_2021-12-16_22-46-50.png)
**TODO:** separate the parameters in two different forms and save only the parameters of the considered tab.
See [client/src/components/admin/Settings/System.vue](https://framagit.org/InfoLibre/rapido/-/blob/master/client/src/components/admin/Settings/System.vue).https://framagit.org/InfoLibre/rapido/-/issues/141Add a search engine2023-07-23T15:58:01ZInfoLibredavid.vantyghem@laposte.netAdd a search engineAdd a search engine to index uploaded Office documents and registered pages+contents.
- [Datafari](https://datafari.com)
- [Quickwit](https://quickwit.io)
- [Typesense](https://jbuget.fr/posts/a-la-decouverte-de-typesense-le-moteur-de-r...Add a search engine to index uploaded Office documents and registered pages+contents.
- [Datafari](https://datafari.com)
- [Quickwit](https://quickwit.io)
- [Typesense](https://jbuget.fr/posts/a-la-decouverte-de-typesense-le-moteur-de-recherche-open-source/)
- [Meilisearch](https://www.meilisearch.com)
In Go:
- [Riot](https://github.com/go-ego/riot)
- [Bleve](https://github.com/blevesearch)https://framagit.org/InfoLibre/rapido/-/issues/140Navigation menu: 2 submenus are deleted when one delete a submenu2022-01-07T20:56:33ZInfoLibredavid.vantyghem@laposte.netNavigation menu: 2 submenus are deleted when one delete a submenuIn navigation menu, if one delete a submenu, the submenu that is directly placed below is deleted too. The other sub-menus are not deleted.
Example: if one delete submenu "Home36", only this submenu is deleted. But if one delete submenu...In navigation menu, if one delete a submenu, the submenu that is directly placed below is deleted too. The other sub-menus are not deleted.
Example: if one delete submenu "Home36", only this submenu is deleted. But if one delete submenu "Home4", submenus "Home4" and "Home36" are deleted:
![Capture_d_écran_du_2021-11-29_09-12-17](/uploads/06ad292ec943e307f1d5983f4e7b84e3/Capture_d_écran_du_2021-11-29_09-12-17.png)
Expected: only one submenu should be deleted.https://framagit.org/InfoLibre/rapido/-/issues/139Menu Settings - Pages: deleting more than one page displays an error message2022-01-14T08:18:29ZInfoLibredavid.vantyghem@laposte.netMenu Settings - Pages: deleting more than one page displays an error messageIn menu Settings - Pages, if one delete a page, the page is deleted, a success message is displayed ans the next page parameters appears. If one delete immediately the next page, it isn't deleted and an error message is displayed, as if ...In menu Settings - Pages, if one delete a page, the page is deleted, a success message is displayed ans the next page parameters appears. If one delete immediately the next page, it isn't deleted and an error message is displayed, as if one tried to delete the precedent deleted page:
![Capture_d_écran_du_2021-11-26_09-03-41](/uploads/7b83c06163c291d10d2c8fb0e6421ccd/Capture_d_écran_du_2021-11-26_09-03-41.png)https://framagit.org/InfoLibre/rapido/-/issues/137Menu Settings - Pages: button "See this page" doesn't work if the page is in ...2021-12-30T17:15:39ZInfoLibredavid.vantyghem@laposte.netMenu Settings - Pages: button "See this page" doesn't work if the page is in the second page of the listIn menu Settings - Pages, one can go and see a page by clicking on button "See this page".
But if there are a lot of page and if one wants to go and see a page that is in the second page of the list, one is redirected to a wrong page.
...In menu Settings - Pages, one can go and see a page by clicking on button "See this page".
But if there are a lot of page and if one wants to go and see a page that is in the second page of the list, one is redirected to a wrong page.
![Capture_d_écran_du_2021-11-25_23-21-36](/uploads/af669153147e9bb9593843a42e521ad0/Capture_d_écran_du_2021-11-25_23-21-36.png)
**TODO**: if there are a lot of page and if one wants to go and see a page that is in the secont list, one must be redirected to the corresponding page.https://framagit.org/InfoLibre/rapido/-/issues/134Portability of Rapido2021-11-29T08:55:15ZInfoLibredavid.vantyghem@laposte.netPortability of RapidoDoes Rapido work on Windows and macOS?
Examples:
UNIX path hardcoded in https://framagit.org/InfoLibre/rapido/-/blob/master/models/email/sendMail.go, in https://framagit.org/InfoLibre/rapido/-/blob/master/models/library/db.go
**TODO**...Does Rapido work on Windows and macOS?
Examples:
UNIX path hardcoded in https://framagit.org/InfoLibre/rapido/-/blob/master/models/email/sendMail.go, in https://framagit.org/InfoLibre/rapido/-/blob/master/models/library/db.go
**TODO**: test Rapido on Windows and macOS and solve bugs.InfoLibredavid.vantyghem@laposte.netInfoLibredavid.vantyghem@laposte.nethttps://framagit.org/InfoLibre/rapido/-/issues/132Impossible to move a Contact form in a page2022-01-06T17:10:21ZInfoLibredavid.vantyghem@laposte.netImpossible to move a Contact form in a pageIt's impossible to move a Contact form in a page. If you move it above another normal content, it comes back below the normal content, after registering the modifications. The Contact form always stay at the bottom of the page.
It seems...It's impossible to move a Contact form in a page. If you move it above another normal content, it comes back below the normal content, after registering the modifications. The Contact form always stay at the bottom of the page.
It seems there's a problem with the **location** value in the database.
Contact form is registered in the database as beeing in the footer:
![Capture_d_écran_du_2021-12-31_08-13-25__copie_](/uploads/f4d0f4f900ca048ed45ebfa485bf6a1c/Capture_d_écran_du_2021-12-31_08-13-25__copie_.png)
In razorCMS, contents were in **header**, **main** or **footer**. But in Rapido, all Contents and all Contact forms must be only in **main**.
**TODO 1**: a Contact form must be able to be moved at the top or at the middle of a page.
**TODO 2**: all Contents and all Contact forms, must be in **main**, not in head or footer. If possible, delete **location** column with head, main and footer values in **page_content** table. Use only **position** values? (position = 1, 2, 3...). See https://framagit.org/InfoLibre/rapido/-/issues/157https://framagit.org/InfoLibre/rapido/-/issues/131Translations: add a different text in each search bar2021-11-21T15:48:42ZInfoLibredavid.vantyghem@laposte.netTranslations: add a different text in each search barText is always the same in search bar (see search_engine__search in lang/*.json):
![d](/uploads/4fe416691e56e43bf788f7e6c4ced174/d.png)
**TODO**: add translation variables and a different text in each search bar:
- Pages: **Search in ...Text is always the same in search bar (see search_engine__search in lang/*.json):
![d](/uploads/4fe416691e56e43bf788f7e6c4ced174/d.png)
**TODO**: add translation variables and a different text in each search bar:
- Pages: **Search in name**
- Contents: **Search in Name or in Content**
- Files: **Search in Name or by Type**
- Contact forms: **Search in Name or in Recipient email address**
See [DataQuery.vue](https://framagit.org/InfoLibre/rapido/-/blob/master/client/src/components/global/DataQuery.vue) and [DataQueryTable.vue](https://framagit.org/InfoLibre/rapido/-/blob/master/client/src/components/global/DataQueryTable.vue).