You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ofbiz.apache.org by jl...@apache.org on 2026/04/13 13:20:53 UTC
(ofbiz-plugins) branch trunk updated: Fixed: jsgantt-improved bloks qs.js update (OFBIZ-13339)
This is an automated email from the ASF dual-hosted git repository.
jleroux pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-plugins.git
The following commit(s) were added to refs/heads/trunk by this push:
new aae7fb0ea Fixed: jsgantt-improved bloks qs.js update (OFBIZ-13339)
aae7fb0ea is described below
commit aae7fb0ea65c2259e52049e2fcfe941d25797188
Author: Jacques Le Roux <ja...@les7arts.com>
AuthorDate: Mon Apr 13 15:21:07 2026 +0200
Fixed: jsgantt-improved bloks qs.js update (OFBIZ-13339)
We recently completely removed the Gant feature in project application because
it had multiple serious security issues, and we thought that it was not
maintained.
Finally with https://github.com/jsGanttImproved/jsgantt-improved/issues/384
The jsgantt-improved project should be safe again. At least, according to the
author of the fix, npm does not find any issue and I can confirm that:
audited 18 packages in 0.422s
found 0 vulnerabilities
But I'm still unsure because the security issues were reported to us by
Dependabot and not npm. And before npm did not alert us, maybe because it only
verifies packages in framework and application (not sure about that, I'll dig it)
Note also that both npm and Dependabot are both GH's creations
We will see if Dependabot does not report security issues, else a revert of this
commit will be necessary again.
If it's OK a backport to 24.09 will be done.
Thanks: Mario Mol and Claude Code
---
projectmgr/README.md | 1 +
projectmgr/config/ProjectMgrUiLabels.xml | 24 ++++++++++++++++
.../src/docs/asciidoc/_include/prjm_project.adoc | 1 +
.../webapp/projectmgr/WEB-INF/controller.xml | 10 +++++--
projectmgr/webapp/projectmgr/WEB-INF/web.xml | 2 +-
projectmgr/widget/CommonScreens.xml | 1 +
projectmgr/widget/ProjectMenus.xml | 8 ++++++
projectmgr/widget/ProjectScreens.xml | 32 ++++++++++++++++++++++
8 files changed, 76 insertions(+), 3 deletions(-)
diff --git a/projectmgr/README.md b/projectmgr/README.md
index 9ffa2dda5..dec6f01f3 100644
--- a/projectmgr/README.md
+++ b/projectmgr/README.md
@@ -13,6 +13,7 @@ The Project Management application enables organisations to manage their interna
Resource assignement to projects
Resource allocation to tasks
Approval of time spent on tasks
+ Gantt charts for projects, phases and tasks
Time registration with different rates
Generate invoice from a project
Project copy
diff --git a/projectmgr/config/ProjectMgrUiLabels.xml b/projectmgr/config/ProjectMgrUiLabels.xml
index b369123db..b07a11874 100644
--- a/projectmgr/config/ProjectMgrUiLabels.xml
+++ b/projectmgr/config/ProjectMgrUiLabels.xml
@@ -833,6 +833,18 @@
<value xml:lang="zh">项目账单</value>
<value xml:lang="zh-TW">專案帳單</value>
</property>
+ <property key="PageTitleProjectGanttChart">
+ <value xml:lang="de">Projekt Gantt Chart</value>
+ <value xml:lang="en">Project Gantt Chart</value>
+ <value xml:lang="fr">Graphe Gantt du projet</value>
+ <value xml:lang="it">Progetto grafico gantt</value>
+ <value xml:lang="ja">プロジェクトガントチャート</value>
+ <value xml:lang="nl">Gant chart</value>
+ <value xml:lang="th">แผนผังคุมการกำหนดโปรเจค</value>
+ <value xml:lang="vi">Biểu đồ CHUNG của dự án</value>
+ <value xml:lang="zh">项目甘特图</value>
+ <value xml:lang="zh-TW">專案甘特圖</value>
+ </property>
<property key="PageTitleProjectInformation">
<value xml:lang="de">Projektinformationen</value>
<value xml:lang="en">Project Information</value>
@@ -1494,6 +1506,18 @@
<value xml:lang="zh">周五</value>
<value xml:lang="zh-TW">週五</value>
</property>
+ <property key="ProjectMgrGanttChart">
+ <value xml:lang="de">Gantt Chart</value>
+ <value xml:lang="en">Gantt Chart</value>
+ <value xml:lang="fr">Diagramme de Gantt</value>
+ <value xml:lang="it">Grafico gantt</value>
+ <value xml:lang="ja">ガントチャート</value>
+ <value xml:lang="nl">GANT chart</value>
+ <value xml:lang="th">แผนผังคุมการกำหนดงาน</value>
+ <value xml:lang="vi">Biểu đồ CHUNG</value>
+ <value xml:lang="zh">甘特图</value>
+ <value xml:lang="zh-TW">甘特圖</value>
+ </property>
<property key="ProjectMgrListMailingList">
<value xml:lang="de">Liste Mailing-List auf</value>
<value xml:lang="en">List Mailing List</value>
diff --git a/projectmgr/src/docs/asciidoc/_include/prjm_project.adoc b/projectmgr/src/docs/asciidoc/_include/prjm_project.adoc
index 837b28d6c..b986246a7 100644
--- a/projectmgr/src/docs/asciidoc/_include/prjm_project.adoc
+++ b/projectmgr/src/docs/asciidoc/_include/prjm_project.adoc
@@ -23,6 +23,7 @@ It is also the starting point to navigate to the various sub screens related to
== Sub screens
Following sub screens are provided:
+* Gantt chart
* Mailing List
* Phases
* Tasks
diff --git a/projectmgr/webapp/projectmgr/WEB-INF/controller.xml b/projectmgr/webapp/projectmgr/WEB-INF/controller.xml
index 4ce7ef832..5123cb3e6 100644
--- a/projectmgr/webapp/projectmgr/WEB-INF/controller.xml
+++ b/projectmgr/webapp/projectmgr/WEB-INF/controller.xml
@@ -34,6 +34,11 @@
<response name="success" type="view" value="main"/>
</request-map>
+ <request-map uri="ganttChart">
+ <security https="true" auth="true"/>
+ <response name="success" type="view" value="ganttChart"/>
+ </request-map>
+
<request-map uri="ListSubProjects">
<security https="true" auth="true"/>
<response name="success" type="view" value="ListSubProjects"/>
@@ -107,8 +112,8 @@
<request-map uri="scheduleProject">
<security https="true" auth="true"/>
<event type="service" invoke="scheduleProject"/>
- <response name="success" type="view" value="projectView"/>
- <response name="error" type="view" value="projectView"/>
+ <response name="success" type="view" value="ganttChart"/>
+ <response name="error" type="view" value="ganttChart"/>
</request-map>
<request-map uri="FindResource">
<security https="true" auth="true"/>
@@ -692,6 +697,7 @@
<view-map name="EditPartyRates" type="screen" page="component://projectmgr/widget/ResourceScreens.xml#EditPartyRates"/>
<view-map name="main" type="screen" page="component://projectmgr/widget/CommonScreens.xml#Main"/>
+ <view-map name="ganttChart" type="screen" page="component://projectmgr/widget/ProjectScreens.xml#ganttChart"/>
<view-map name="ListSubProjects" type="screen" page="component://projectmgr/widget/ProjectScreens.xml#ListSubProjects"/>
<view-map name="FindResource" type="screen" page="component://projectmgr/widget/ResourceScreens.xml#FindResource"/>
<view-map name="FindProject" type="screen" page="component://projectmgr/widget/ProjectScreens.xml#FindProject"/>
diff --git a/projectmgr/webapp/projectmgr/WEB-INF/web.xml b/projectmgr/webapp/projectmgr/WEB-INF/web.xml
index d86c38317..2aa29a5d7 100644
--- a/projectmgr/webapp/projectmgr/WEB-INF/web.xml
+++ b/projectmgr/webapp/projectmgr/WEB-INF/web.xml
@@ -64,7 +64,7 @@
<filter-class>org.apache.ofbiz.webapp.control.ControlFilter</filter-class>
<init-param>
<param-name>allowedPaths</param-name>
- <param-value>/error:/control:/select:/index.html:/index.jsp:/default.html:/default.jsp:/images</param-value>
+ <param-value>/error:/control:/select:/index.html:/index.jsp:/default.html:/default.jsp:/images:/static:/js:/node_modules/jsgantt-improved</param-value>
</init-param>
<init-param>
<param-name>redirectPath</param-name>
diff --git a/projectmgr/widget/CommonScreens.xml b/projectmgr/widget/CommonScreens.xml
index 7216090d1..647770272 100644
--- a/projectmgr/widget/CommonScreens.xml
+++ b/projectmgr/widget/CommonScreens.xml
@@ -39,6 +39,7 @@ under the License.
<!-- layoutSettings.headerImageUrl can be used to specify an application specific logo; if not set,
then the global layoutSettings.commonHeaderImageUrl (specified in GlobalDecorator) will be used. -->
<!--<set field="layoutSettings.headerImageUrl" value="/images/ofbiz_logo.png" global="true"/>-->
+ <set field="layoutSettings.styleSheets[]" value="/projectmgr/static/projectmgr.css" global="true"/>
<set field="activeApp" value="projectmgr" global="true"/>
<set field="applicationMenuName" value="ProjectMgrAppBar" global="true"/>
<set field="applicationMenuLocation" value="${parameters.mainMenuLocation}" global="true"/>
diff --git a/projectmgr/widget/ProjectMenus.xml b/projectmgr/widget/ProjectMenus.xml
index cab8eb9e5..0a0b3f163 100644
--- a/projectmgr/widget/ProjectMenus.xml
+++ b/projectmgr/widget/ProjectMenus.xml
@@ -83,6 +83,14 @@
"projectId", projectId));
return result.get("hasPermission"); }" type="Boolean"/>
</actions>
+ <menu-item name="ganttchart" title="${uiLabelMap.ProjectMgrGanttChart}">
+ <condition>
+ <if-compare field="hasViewPermission" operator="equals" value="true"/>
+ </condition>
+ <link target="ganttChart">
+ <parameter param-name="projectId"/>
+ </link>
+ </menu-item>
<menu-item name="projectView" title="${uiLabelMap.ProjectMgrProjectSummary}">
<condition>
<if-compare field="hasViewPermission" operator="equals" value="true"/>
diff --git a/projectmgr/widget/ProjectScreens.xml b/projectmgr/widget/ProjectScreens.xml
index fddf47acd..0ee555b9f 100644
--- a/projectmgr/widget/ProjectScreens.xml
+++ b/projectmgr/widget/ProjectScreens.xml
@@ -419,6 +419,29 @@ under the License.
</widgets>
</section>
</screen>
+ <screen name="ganttChart">
+ <section>
+ <actions>
+ <set field="titleProperty" value="ProjectMgrGanttChart"/>
+ <set field="tabButtonItem" value="ganttchart"/>
+ <set field="layoutSettings.styleSheets[]" value="/projectmgr/node_modules/jsgantt-improved/dist/jsgantt.css" global="true"/>
+ <set field="layoutSettings.styleSheets[]" value="/projectmgr/static/projectmgr.css" global="true"/>
+ <script location="component://projectmgr/src/main/groovy/org/apache/ofbiz/projectmgr/GanttChart.groovy"/>
+ </actions>
+ <widgets>
+ <label text="${project}"/>
+ <decorator-screen name="CommonProjectDecorator" location="${parameters.mainDecoratorLocation}">
+ <decorator-section name="body">
+ <screenlet title="${uiLabelMap.PageTitleProjectGanttChart}">
+ <platform-specific>
+ <html><html-template multi-block="true" location="component://projectmgr/template/project/GanttChart.ftl"/></html>
+ </platform-specific>
+ </screenlet>
+ </decorator-section>
+ </decorator-screen>
+ </widgets>
+ </section>
+ </screen>
<screen name="SubProjectsInfo">
<section>
<actions>
@@ -957,6 +980,8 @@ under the License.
<section>
<actions>
<property-map resource="ProjectMgrUiLabels" map-name="uiLabelMap" global="true"/>
+ <set field="layoutSettings.styleSheets[]" value="/projectmgr/node_modules/jsgantt-improved/dist/jsgantt.css" global="true"/>
+ <set field="layoutSettings.styleSheets[]" value="/projectmgr/static/projectmgr.css" global="true"/>
<entity-condition entity-name="WorkEffortPartyAssignByGroup" list="projects" filter-by-date="true">
<condition-list combine="and">
<condition-expr field-name="partyId" from-field="userLogin.partyId"/>
@@ -974,6 +999,7 @@ under the License.
<actions>
<set field="projectId" from-field="project.workEffortId"/>
<set field="parameters.projectId" from-field="project.workEffortId"/>
+ <script location="component://projectmgr/src/main/groovy/org/apache/ofbiz/projectmgr/GanttChart.groovy"/>
<service service-name="getProject" result-map="result">
<field-map field-name="projectId" from-field="projectId"/>
</service>
@@ -1016,6 +1042,12 @@ under the License.
</widgets>
</section>
</container>
+ <container style="clear"/>
+ <screenlet title="${uiLabelMap.PageTitleProjectGanttChart}">
+ <platform-specific>
+ <html><html-template multi-block="true" location="component://projectmgr/template/project/GanttChart.ftl"/></html>
+ </platform-specific>
+ </screenlet>
</widgets>
</section>
</iterate-section>
Re: (ofbiz-plugins) branch trunk updated: Fixed: jsgantt-improved bloks qs.js update (OFBIZ-13339)
Posted by Jacques Le Roux via dev <de...@ofbiz.apache.org>.
OK, makes sense
Le 13/04/2026 à 17:47, Jacopo Cappellato a écrit :
> On Mon, Apr 13, 2026 at 5:13 PM Jacques Le Roux via dev <
> dev@ofbiz.apache.org> wrote:
>
>> [...]
>> So now it's mandatory to else put patches in Jira or create PRs from a
>> fork?
>
> Hi Jacques,
>
> It’s not mandatory, but it is a best practice (I’ll soon propose a document
> about this to the community).
>
> I’m suggesting it because it would help reduce issues like frequent reverts
> or commits with incorrect metadata, thanks to better review and
> traceability.
>
> Best regards,
> Jacopo
Re: (ofbiz-plugins) branch trunk updated: Fixed: jsgantt-improved bloks qs.js update (OFBIZ-13339)
Posted by Jacopo Cappellato <ja...@gmail.com>.
On Mon, Apr 13, 2026 at 5:13 PM Jacques Le Roux via dev <
dev@ofbiz.apache.org> wrote:
> [...]
> So now it's mandatory to else put patches in Jira or create PRs from a
> fork?
Hi Jacques,
It’s not mandatory, but it is a best practice (I’ll soon propose a document
about this to the community).
I’m suggesting it because it would help reduce issues like frequent reverts
or commits with incorrect metadata, thanks to better review and
traceability.
Best regards,
Jacopo
Re: (ofbiz-plugins) branch trunk updated: Fixed: jsgantt-improved bloks qs.js update (OFBIZ-13339)
Posted by Jacques Le Roux via dev <de...@ofbiz.apache.org>.
Done
Le 13/04/2026 à 17:10, Jacques Le Roux via dev a écrit :
> Hi Jacopo,
>
> Right, I missed that it was not yet released trough npm.
>
> Anyway it does not pass Dependabot check because of the node version used.
> I was filling a comment about that on https://issues.apache.org/jira/browse/OFBIZ-13339
> Just after the commit, but did not finish. I'll finsih it now and revert myself
>
> So now it's mandatory to else put patches in Jira or create PRs from a fork?
>
> Jacques
>
> Le 13/04/2026 à 15:47, Jacopo Cappellato a écrit :
>> Hi Jacques,
>>
>> I don't understand what you are doing. The latest npm release of
>> *jsgantt-improved* is from three years ago and definitely does not include
>> a fix created yesterday.
>>
>> Also, could you please work in feature branches on your fork and submit
>> pull requests from there? By pushing directly to the main repository, you
>> prevent proper review of your changes. Committing and then reverting is
>> also not a good practice.
>>
>> Since we are currently preparing a release, I don’t think we should take
>> these risks [*]. I'd revert these changes.
>>
>> Best regards,
>> Jacopo
>>
>> [*] From Jacques' commit message:
>>
>> "But I'm still unsure because the security issues were reported to us by
>> Dependabot and not npm. And before npm did not alert us, maybe because
>> it only
>> verifies packages in framework and application (not sure about that,
>> I'll dig it)
>>
>> Note also that both npm and Dependabot are both GH's creations
>>
>> We will see if Dependabot does not report security issues, else a
>> revert of this
>> commit will be necessary again.
>>
>> If it's OK a backport to 24.09 will be done."
Re: (ofbiz-plugins) branch trunk updated: Fixed: jsgantt-improved bloks qs.js update (OFBIZ-13339)
Posted by Jacques Le Roux via dev <de...@ofbiz.apache.org>.
Hi Jacopo,
Right, I missed that it was not yet released trough npm.
Anyway it does not pass Dependabot check because of the node version used.
I was filling a comment about that on https://issues.apache.org/jira/browse/OFBIZ-13339
Just after the commit, but did not finish. I'll finsih it now and revert myself
So now it's mandatory to else put patches in Jira or create PRs from a fork?
Jacques
Le 13/04/2026 à 15:47, Jacopo Cappellato a écrit :
> Hi Jacques,
>
> I don't understand what you are doing. The latest npm release of
> *jsgantt-improved* is from three years ago and definitely does not include
> a fix created yesterday.
>
> Also, could you please work in feature branches on your fork and submit
> pull requests from there? By pushing directly to the main repository, you
> prevent proper review of your changes. Committing and then reverting is
> also not a good practice.
>
> Since we are currently preparing a release, I don’t think we should take
> these risks [*]. I'd revert these changes.
>
> Best regards,
> Jacopo
>
> [*] From Jacques' commit message:
>
> "But I'm still unsure because the security issues were reported to us by
> Dependabot and not npm. And before npm did not alert us, maybe because
> it only
> verifies packages in framework and application (not sure about that,
> I'll dig it)
>
> Note also that both npm and Dependabot are both GH's creations
>
> We will see if Dependabot does not report security issues, else a
> revert of this
> commit will be necessary again.
>
> If it's OK a backport to 24.09 will be done."
Re: (ofbiz-plugins) branch trunk updated: Fixed: jsgantt-improved bloks qs.js update (OFBIZ-13339)
Posted by Jacopo Cappellato <ja...@gmail.com>.
Hi Jacques,
I don't understand what you are doing. The latest npm release of
*jsgantt-improved* is from three years ago and definitely does not include
a fix created yesterday.
Also, could you please work in feature branches on your fork and submit
pull requests from there? By pushing directly to the main repository, you
prevent proper review of your changes. Committing and then reverting is
also not a good practice.
Since we are currently preparing a release, I don’t think we should take
these risks [*]. I'd revert these changes.
Best regards,
Jacopo
[*] From Jacques' commit message:
"But I'm still unsure because the security issues were reported to us by
Dependabot and not npm. And before npm did not alert us, maybe because
it only
verifies packages in framework and application (not sure about that,
I'll dig it)
Note also that both npm and Dependabot are both GH's creations
We will see if Dependabot does not report security issues, else a
revert of this
commit will be necessary again.
If it's OK a backport to 24.09 will be done."