From e0ca960a35cf006880019ba28fc82aa30f289a71 Mon Sep 17 00:00:00 2001
From: Lauri Ojansivu <x@xet7.org>
Date: Sat, 22 Feb 2020 02:49:14 +0200
Subject: Create New User in Admin Panel. Works, but does not save fullname
 yet, so currently it's needed to edit add fullname later.

Thanks to xet7 !

Related #802
---
 client/components/settings/peopleBody.jade | 52 ++++++++++++++++++++++++++++++
 1 file changed, 52 insertions(+)

(limited to 'client/components/settings/peopleBody.jade')

diff --git a/client/components/settings/peopleBody.jade b/client/components/settings/peopleBody.jade
index b8a94337..ca4bc382 100644
--- a/client/components/settings/peopleBody.jade
+++ b/client/components/settings/peopleBody.jade
@@ -40,9 +40,15 @@ template(name="peopleGeneral")
         th {{_ 'active'}}
         th {{_ 'authentication-method'}}
         th
+          +newUserRow
       each user in peopleList
         +peopleRow(userId=user._id)
 
+template(name="newUserRow")
+  a.new-user
+    i.fa.fa-edit
+    | {{_ 'new'}}
+
 template(name="peopleRow")
   tr
     if userData.loginDisabled
@@ -148,3 +154,49 @@ template(name="editUserPopup")
     //  div
     //  input#deleteButton.primary.wide(type="button" value="{{_ 'delete'}}")
 
+template(name="newUserPopup")
+  form
+    //label.hide.userId(type="text" value=user._id)
+    label
+      | {{_ 'fullname'}}
+      input.js-profile-fullname(type="text" value="" autofocus)
+    label
+      | {{_ 'username'}}
+      span.error.hide.username-taken
+        | {{_ 'error-username-taken'}}
+      //if isLdap
+      //  input.js-profile-username(type="text" value=user.username readonly)
+      //else
+      input.js-profile-username(type="text" value="")
+    label
+      | {{_ 'email'}}
+      span.error.hide.email-taken
+        | {{_ 'error-email-taken'}}
+      //if isLdap
+      //  input.js-profile-email(type="email" value="{{user.emails.[0].address}}" readonly)
+      //else
+      input.js-profile-email(type="email" value="")
+    label
+      | {{_ 'admin'}}
+      select.select-role.js-profile-isadmin
+        option(value="false" selected="selected") {{_ 'no'}}
+        option(value="true") {{_ 'yes'}}
+    label
+      | {{_ 'active'}}
+      select.select-active.js-profile-isactive
+        option(value="false" selected="selected") {{_ 'yes'}}
+        option(value="true") {{_ 'no'}}
+    label
+      | {{_ 'authentication-type'}}
+      select.select-authenticationMethod.js-authenticationMethod
+        each authentications
+          if isSelected value
+            option(value="{{value}}" selected) {{_ value}}
+          else
+            option(value="{{value}}") {{_ value}}
+    hr
+    label
+      | {{_ 'password'}}
+      input.js-profile-password(type="password")
+    div.buttonsContainer
+      input.primary.wide(type="submit" value="{{_ 'save'}}")
-- 
cgit v1.2.3-1-g7c22


From aac7c380c8c389b0683b2bd64e2cc856993f0e30 Mon Sep 17 00:00:00 2001
From: Lauri Ojansivu <x@xet7.org>
Date: Sun, 1 Mar 2020 20:59:53 +0200
Subject: - Fix critical and moderate security vulnerabilities reported at
 2020-02-26 with   responsible disclosure by [Dejan
 Zelic](https://twitter.com/dejandayoff),   Justin Benjamin and others at
 [Offensive Security](https://twitter.com/offsectraining),   that follow
 standard 90 days before public disclosure.   Thanks to xet7. - Fix webhook
 error that prevented some card etc deleting from web UI of board.   Thanks to
 xet7. - Add some more Font Awesome icons.   Thanks to xet7. - Remove
 autofocus from many form input boxes so that they would not cause warnings.  
 Thanks to xet7.

---
 client/components/settings/peopleBody.jade | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'client/components/settings/peopleBody.jade')

diff --git a/client/components/settings/peopleBody.jade b/client/components/settings/peopleBody.jade
index ca4bc382..fef1067e 100644
--- a/client/components/settings/peopleBody.jade
+++ b/client/components/settings/peopleBody.jade
@@ -110,7 +110,7 @@ template(name="editUserPopup")
     label.hide.userId(type="text" value=user._id)
     label
       | {{_ 'fullname'}}
-      input.js-profile-fullname(type="text" value=user.profile.fullname autofocus)
+      input.js-profile-fullname(type="text" value=user.profile.fullname)
     label
       | {{_ 'username'}}
       span.error.hide.username-taken
@@ -159,7 +159,7 @@ template(name="newUserPopup")
     //label.hide.userId(type="text" value=user._id)
     label
       | {{_ 'fullname'}}
-      input.js-profile-fullname(type="text" value="" autofocus)
+      input.js-profile-fullname(type="text" value="")
     label
       | {{_ 'username'}}
       span.error.hide.username-taken
-- 
cgit v1.2.3-1-g7c22