framadate issueshttps://framagit.org/framasoft/framadate/framadate/-/issues2021-03-08T17:53:39Zhttps://framagit.org/framasoft/framadate/framadate/-/issues/532L'option "il n'est plus possible de voter" provoque une erreur 500 / Error 50...2021-03-08T17:53:39ZspfL'option "il n'est plus possible de voter" provoque une erreur 500 / Error 500 for "Votes and comments are locked"Pour reproduire :
1. créer un Framadate
1. changer l'option de vote pour **Il n'est plus possible de voter**
1. cliquer sur l'icône pour enregistrer le changement
1. erreur 500
Testé sur https://framadate.org/ et https://date.chapril.o...Pour reproduire :
1. créer un Framadate
1. changer l'option de vote pour **Il n'est plus possible de voter**
1. cliquer sur l'icône pour enregistrer le changement
1. erreur 500
Testé sur https://framadate.org/ et https://date.chapril.org/
---
Steps to reproduce:
1. create Framadate
1. change option to **Votes and comments are locked**
1. click icon to save
1. error 500
Tested on https://framadate.org/ and https://date.chapril.org/1.1.13https://framagit.org/framasoft/framadate/framadate/-/issues/465Translate unknown answer in produced CSV2021-12-21T09:55:59ZThomasthomas.citharel@framasoft.orgTranslate unknown answer in produced CSVThe following discussion from !413 should be addressed:
- [ ] @tcit started a [discussion](https://framagit.org/framasoft/framadate/framadate/merge_requests/413#note_468298):
> Needs to be translated as well (and typo fixed).The following discussion from !413 should be addressed:
- [ ] @tcit started a [discussion](https://framagit.org/framasoft/framadate/framadate/merge_requests/413#note_468298):
> Needs to be translated as well (and typo fixed).1.1.18https://framagit.org/framasoft/framadate/framadate/-/issues/578Invalid localization of dates in Czech2022-04-28T10:34:03ZJakub FreywaldInvalid localization of dates in CzechI am using an English localization by default, but being situated in the Czech Republic, I have the option to switch to Czech.
I created some options in the timetable in English, but when I switched to Czech, the dates did not translate ...I am using an English localization by default, but being situated in the Czech Republic, I have the option to switch to Czech.
I created some options in the timetable in English, but when I switched to Czech, the dates did not translate properly. (see screenshots) Also month names did not translate at all.
![English](/uploads/519f4b84adfaae3451c6542e38a1e3bb/Screenshot_2022-04-28_at_12.20.15.png)
![Czech](/uploads/21a0391402030193cd1da26c20e9ad43/Screenshot_2022-04-28_at_12.20.52.png)1.1.20https://framagit.org/framasoft/framadate/framadate/-/issues/573Warning: Attempt to read property "value" on null2022-04-14T06:48:54ZHuidae ChoWarning: Attempt to read property "value" on nullI'm using Framadate 1.1.19.
When in the admin mode, viewing an old poll shows this warning at the bottom:
```
Warning: Attempt to read property "value" on null in /home/user/public_html/framadate/tpl_c/d115c226b0501afc289dde584cfc52ee5f...I'm using Framadate 1.1.19.
When in the admin mode, viewing an old poll shows this warning at the bottom:
```
Warning: Attempt to read property "value" on null in /home/user/public_html/framadate/tpl_c/d115c226b0501afc289dde584cfc52ee5f4bf799_0.file.comments_list.tpl.php on line 28
```
In line 27 of that file,
```php
<form action="<?php if ((isset($_smarty_tpl->tpl_vars['admin']->value))) {
```
`$_smarty_tpl->tpl_vars['admin']->value` is set (`isset()` true), but it is empty for some reason (`isset()` still true). **It can be set to a falsy value, so it shouldn't be enough to just check if it is set.** In line 28,
```php
echo smarty_function_poll_url(array('id'=>$_smarty_tpl->tpl_vars['admin_poll_id']->value,'admin'=>true),$_smarty_tpl);
```
`$_smarty_tpl->tpl_vars['admin_poll_id']` is not defined (null) and reading "value" on this null triggers the above warning.
## Version 1.1.10
In version 1.1.10, line 27 was
```php
<form action="<?php if ($_smarty_tpl->tpl_vars['admin']->value) {
```
so a set-but-empty `$_smarty_tpl->tpl_vars['admin']->value` was false and `$_smarty_tpl->tpl_vars['admin_poll_id']` was never evaluated.
## Probably
Line 27 was meant to be
```php
<form action="<?php if (isset($_smarty_tpl->tpl_vars['admin']->value) && $_smarty_tpl->tpl_vars['admin']->value) {
```
or even just like in version 1.1.10
```php
<form action="<?php if ($_smarty_tpl->tpl_vars['admin']->value) {
```1.1.20Thomasthomas.citharel@framasoft.orgThomasthomas.citharel@framasoft.orghttps://framagit.org/framasoft/framadate/framadate/-/issues/571CSV export : some columns are empty2022-04-14T06:45:27ZMarc LangevinCSV export : some columns are emptyIf some choices contain comma(s), the CSV is messed up, because the values rows are correctly quoted, but not the first headers row.If some choices contain comma(s), the CSV is messed up, because the values rows are correctly quoted, but not the first headers row.1.1.20https://framagit.org/framasoft/framadate/framadate/-/issues/546XSS in markdown parsing in /create_poll.php2021-03-23T02:17:33ZmartgilXSS in markdown parsing in /create_poll.phpThere was an XSS on the current version of the framadate.
Prerequisite:
A local installation of framadate instance is needed.
Markdown Payload :
```
[Click Me](http://onclick=setTimeout`prompt\u0028document.domain\u0029`//)
```
Steps...There was an XSS on the current version of the framadate.
Prerequisite:
A local installation of framadate instance is needed.
Markdown Payload :
```
[Click Me](http://onclick=setTimeout`prompt\u0028document.domain\u0029`//)
```
Steps to reproduce:
1. Visit https://localhost/create_poll.php?type=date
2. Enter payload above.
3. Click on the preview. Then click the text link.
4. Javascript will execute.
Ps; Many websites are suffering with this XSS. I have reach you guys so It could be fixed really soon as It was suggested to me by those websites that are affected.
```
Hey,
- First of all, the website is running open source software that is developed by others, we are just using it. To have the biggest impact with your report, I suggest you notify the developers directly. Their website is at <https://framadate.org/>, their development is done here <https://framagit.org/framasoft/framadate>. This way, your report would be processed at the source of all installations.
Thanks again
```
I hope this could be fixed soon;
Best,1.1.15https://framagit.org/framasoft/framadate/framadate/-/issues/486Fork i18n lib in 1.1.x to fix some issues2020-12-14T17:02:24ZThomasthomas.citharel@framasoft.orgFork i18n lib in 1.1.x to fix some issuesFork it here and patch things like https://github.com/olivierperez/o80-i18n/pull/8Fork it here and patch things like https://github.com/olivierperez/o80-i18n/pull/81.1.11https://framagit.org/framasoft/framadate/framadate/-/issues/457Bad escapment of e-mail subject2023-03-13T09:11:07ZNils Van ZuijlenBad escapment of e-mail subjectThe date name is HTML-escaped in the mail subject.
For example, I received a message whose subject was
`[Framadate][Pour diffusion aux sondés] Sondage: R&eacute;union bureau BDI`
when it should have been
`[Framadate][Pour diffusion aux ...The date name is HTML-escaped in the mail subject.
For example, I received a message whose subject was
`[Framadate][Pour diffusion aux sondés] Sondage: Réunion bureau BDI`
when it should have been
`[Framadate][Pour diffusion aux sondés] Sondage: Réunion bureau BDI`1.1.20Thomasthomas.citharel@framasoft.orgThomasthomas.citharel@framasoft.orghttps://framagit.org/framasoft/framadate/framadate/-/issues/437Remove collect_users_mail in 1.1.x versions2020-12-14T17:03:02ZThomasthomas.citharel@framasoft.orgRemove collect_users_mail in 1.1.x versionsWrongly backported from https://framagit.org/framasoft/framadate/framadate/merge_requests/352
Gives
```
PHP Notice: Undefined property: Framadate\Form::$collect_users_mail
```Wrongly backported from https://framagit.org/framasoft/framadate/framadate/merge_requests/352
Gives
```
PHP Notice: Undefined property: Framadate\Form::$collect_users_mail
```1.1.11https://framagit.org/framasoft/framadate/framadate/-/issues/371Mobile version damaged on develop2018-11-05T15:25:53ZMarc KarassevMobile version damaged on developI tried to open in my mobile browser my running framadate instance but got the following output:![Screenshot_20180912-175326_Firefox](/uploads/be2591b7635a5bad12fae88c29ce3c3e/Screenshot_20180912-175326_Firefox.jpg)
whereas the output i...I tried to open in my mobile browser my running framadate instance but got the following output:![Screenshot_20180912-175326_Firefox](/uploads/be2591b7635a5bad12fae88c29ce3c3e/Screenshot_20180912-175326_Firefox.jpg)
whereas the output is normal on my computer's browser.
I'm using Firefox for Android 62.0.1 and got the same problem with Chrome for Android.
Steps to reproduce:
- clone the repository
- checkout the `develop` branch
- run `docker-compose up`
- access from your mobile browser to your running instance
Am I missing something?1.2.0https://framagit.org/framasoft/framadate/framadate/-/issues/352XSS security issue2018-07-09T09:18:24ZThomasthomas.citharel@framasoft.orgXSS security issueReported by https://www.bof.nl
> Dear Security Team,
> I noticed Post based XSS vulnerability on kies.bof.nl. There is Poll creation functionality on the website Which is consists of 3 steps. Vulnerability on the 2nd step which is poll ...Reported by https://www.bof.nl
> Dear Security Team,
> I noticed Post based XSS vulnerability on kies.bof.nl. There is Poll creation functionality on the website Which is consists of 3 steps. Vulnerability on the 2nd step which is poll date section.Time field is vulnerable.
>
> Vulnerable url:
> https://kies.bof.nl/create_date_poll.php?type=date
>
> Vulnerable parameter:
> horaires2[]
>
> Payload:
> " onmouseover="alert(document.domain)" bad="
>
> Replication steps:
> 1. go to https://kies.bof.nl/create_date_poll.php?type=date
> 2. field 1st step and press "Go to Step 2" button
> 3. on the 2nd step , choose any date from the calendar.
> 4. type above payload to the time 1, time 2, time 3 field.
> 5. Press "Next" Button
> 6. On the 3rt step, Press "Back" Button
> 7. Move mouse over the time field.
> 8. Popup will be prompted with "kies.bof.nl"
>
> Security Impact:
> Session Hijacking, Redirection to the Malicious website and many more.1.1.5Thomasthomas.citharel@framasoft.orgThomasthomas.citharel@framasoft.orghttps://framagit.org/framasoft/framadate/framadate/-/issues/344Day headers formatted wrong in certain browsers2018-09-12T20:39:09ZThomasthomas.citharel@framasoft.orgDay headers formatted wrong in certain browsers*This issue originally was at https://github.com/framasoft/framadate/issues/67*
I made a poll recently **on the public version of Framatade** of which the headers looked like this on my machine (**Arch Linux with Chrome 60.0.3112.40 (Of...*This issue originally was at https://github.com/framasoft/framadate/issues/67*
I made a poll recently **on the public version of Framatade** of which the headers looked like this on my machine (**Arch Linux with Chrome 60.0.3112.40 (Official Build) beta (64-bit)**):
![](https://i.imgur.com/cjMtOt4.png)
On my friend's computer (**Windows 7 Pro with Chrome 59.0.3071.115 (Official Build) (64-bit)**), they showed up like this:
![](https://i.imgur.com/4SXNFjK.png)
And on another friends mobile (no specs, can ask if requested), they showed up like this as well.
![](https://i.imgur.com/HpwfcDD.png)
My phone (**Android 6.0.1 with Chrome 59.0.3071.125**) it shows the normal column headers.
I guess it could also be a locale issue. I have all my locales set to US English, but considering the column header using "August", I guess the Windows is also configured in English.
--------
(The fact that on mobile it's impossible to see more than one or two columns (on my phone as well, even though the column headers show up correctly) is a separate issue. But if Framadate doesn't intend to be mobile-friendly, that's ok. Tell me if I should report that separately.)1.2.0https://framagit.org/framasoft/framadate/framadate/-/issues/343Make sure config.php has correct permissions2021-09-30T10:52:34ZThomasthomas.citharel@framasoft.orgMake sure config.php has correct permissionsSo that external attackers don't get to see database credentials.So that external attackers don't get to see database credentials.1.2.0https://framagit.org/framasoft/framadate/framadate/-/issues/336Absence de contrôle de la date d'expiration en modification de sondage2022-04-20T10:59:03ZClermontéAbsence de contrôle de la date d'expiration en modification de sondageLors de la création du sondage, le code teste la date saisie par rapport à un minimum et un maximum. Dans create_classic_poll.php, ligne 72 :
```
if ($time < $min_expiry_time) {
$_SESSION['form']->end_date = $min_e...Lors de la création du sondage, le code teste la date saisie par rapport à un minimum et un maximum. Dans create_classic_poll.php, ligne 72 :
```
if ($time < $min_expiry_time) {
$_SESSION['form']->end_date = $min_expiry_time;
} elseif ($max_expiry_time < $time) {
$_SESSION['form']->end_date = $max_expiry_time;
} else {
$_SESSION['form']->end_date = $time;
}
```
Lors de la modification de la date d'expiration après que le sondage soit créé, il n'y a plus ce test. Dans app/classes/Framadate/Service/AdminPollService.php, ligne 37 :
```
function updatePoll($poll) {
global $config;
if ($poll->end_date > $poll->creation_date) {
return $this->pollRepository->update($poll);
} else {
return false;
}
}
```
**Problèmes :**
a) possibilité de mettre une date dans un futur lointain, très lointain… (voir ci-dessus : `if ($poll->end_date > $poll->creation_date) {`) ;
b) possibilité de mettre une date passée alors que factuellement des votes ont pu avoir lieu après cette date.
**Suggestions :**
1) modifier le code pour renforcer le test ;
2) mutualiser le code de test entre create_classic_poll.php, create_date_poll.php et AdminPollService.php.1.2.0https://framagit.org/framasoft/framadate/framadate/-/issues/335Message trompeur dans l'étape 3 de création d'un sondage2019-07-02T10:17:10ZClermontéMessage trompeur dans l'étape 3 de création d'un sondageÀ la création d'un sondage, dans l'étape 3, des information sur l'archivage sont données :
> « Votre sondage sera automatiquement archivé 180 jours après le dernier jour de votre sondage. »
**Problème :** c'est faux. La date d'archiv...À la création d'un sondage, dans l'étape 3, des information sur l'archivage sont données :
> « Votre sondage sera automatiquement archivé 180 jours après le dernier jour de votre sondage. »
**Problème :** c'est faux. La date d'archivage/expiration du sondage est par défaut 180 jours après la date de création (la date du moment).
Fichier PollService.php :
```
/**
* @return int The max timestamp allowed for expiry date
*/
public function maxExpiryDate() {
global $config;
return time() + (86400 * $config['default_poll_duration']);
}
```
**Suggestions :**
- reformuler le message pour préciser ;
- ajouter la différence entre archiver, expiration et suppression ;
- donner une information sur la date de suppression (contrainte RGPD) ;
- faire pareil en anglais.1.2.0https://framagit.org/framasoft/framadate/framadate/-/issues/331Don't push translations if json is invalid2018-05-28T08:04:29ZThomasthomas.citharel@framasoft.orgDon't push translations if json is invalidIf we have an invalid json file (say a comma leftover from a merge), json2po converts it to empty file and zanata pushes it, leading in all strings being destroyed on zanata :see\_no\_evil:
A security can be added by doing:
```bash
pyt...If we have an invalid json file (say a comma leftover from a merge), json2po converts it to empty file and zanata pushes it, leading in all strings being destroyed on zanata :see\_no\_evil:
A security can be added by doing:
```bash
python -m json.tool < locale/en.json &&
```
inside the `locales` section of the makefile before the json2po call.
@luc any better idea ?1.2.0Thomasthomas.citharel@framasoft.orgThomasthomas.citharel@framasoft.orghttps://framagit.org/framasoft/framadate/framadate/-/issues/330Undefined property: stdClass::$valuemax2019-09-09T15:08:16ZThomasthomas.citharel@framasoft.orgUndefined property: stdClass::$valuemaxAdd some coherence `valuemax` -> `valueMax`.Add some coherence `valuemax` -> `valueMax`.1.2.0https://framagit.org/framasoft/framadate/framadate/-/issues/322Better handle undefined config values2018-07-09T09:02:17ZMathieuBetter handle undefined config valuessuite à la fusion de la branche `fork-awesome` (!300), j'ai une erreur "undefined index" puisqu'il manque `provide_fork_awesome` dans mon fichier config.php.
est ce qu'on gère ce cas où les utilisateurs mettent à jour ?
ensuite, cette...suite à la fusion de la branche `fork-awesome` (!300), j'ai une erreur "undefined index" puisqu'il manque `provide_fork_awesome` dans mon fichier config.php.
est ce qu'on gère ce cas où les utilisateurs mettent à jour ?
ensuite, cette clé `provide_fork_awesome` a été ajouté dans `app/inc/config.template.php` mais est ce que ce fichier est encore utilisé ? de souvenir c'est le fichier `tpl/admin/config.tpl` qui est utilisé par le système d'installation.1.1.5https://framagit.org/framasoft/framadate/framadate/-/issues/318error on date poll creation2018-04-19T12:21:05ZMathieuerror on date poll creationquand on accède à l'URL `create_date_poll.php` en dehors des étapes "normales", un objet incorrect est mis dans `$_SESSION['form']` ce qui bloque la création de sondage.quand on accède à l'URL `create_date_poll.php` en dehors des étapes "normales", un objet incorrect est mis dans `$_SESSION['form']` ce qui bloque la création de sondage.1.2.0Thomasthomas.citharel@framasoft.orgThomasthomas.citharel@framasoft.orghttps://framagit.org/framasoft/framadate/framadate/-/issues/302Laisser le commentaire rempli en cas d'erreur de nom2018-04-19T13:21:55ZMathieuLaisser le commentaire rempli en cas d'erreur de nomC'est dans le même ordre d'idée que le soucis suivant : https://framagit.org/framasoft/framadate/issues/194
Quand un commentaire est saisi avec un nom erroné, le commentaire s'efface. Comme il s'agit d'aide à la saisie, je pense qu'on p...C'est dans le même ordre d'idée que le soucis suivant : https://framagit.org/framasoft/framadate/issues/194
Quand un commentaire est saisi avec un nom erroné, le commentaire s'efface. Comme il s'agit d'aide à la saisie, je pense qu'on peut régler cela en JavaScript.1.2.0