Merge remote-tracking branch 'foodcoops/master' into feature-receive

app/assets/javascripts/application.js

@@ -126,6 +126,15 @@ $(function() {
         $(this).children('input[type="submit"]').attr('disabled', 'disabled');
     });
 
+    // The autocomplete attribute is used for both autocompletion and storing
+    // for passwords, it's nice to store it when editing one's own profile,
+    // but never autocomplete. Only implemented for passwords.
+    $('input[type="password"][autocomplete="off"][data-store="on"]').each(function() {
+      $(this).on('change', function() {
+        $(this).removeAttr('autocomplete');
+      });
+    });
+
     // Use bootstrap datepicker for dateinput
     $('.datepicker').datepicker({format: 'yyyy-mm-dd', language: I18n.locale});
 

app/controllers/application_controller.rb

@@ -4,7 +4,7 @@ class ApplicationController < ActionController::Base
   helper_method :available_locales
 
   protect_from_forgery
-  before_filter  :select_foodcoop, :authenticate, :store_controller, :items_per_page, :set_redirect_to
+  before_filter  :select_foodcoop, :authenticate, :store_controller, :items_per_page
   after_filter  :remove_controller
 
   
@@ -80,8 +80,8 @@ class ApplicationController < ActionController::Base
 
   # checks if the current_user is member of given group.
   # if fails the user will redirected to startpage
-  def authenticate_membership_or_admin
-    @group = Group.find(params[:id])
+  def authenticate_membership_or_admin(group_id = params[:id])
+    @group = Group.find(group_id)
     unless @group.member?(@current_user) or @current_user.role_admin?
       redirect_to root_path, alert: I18n.t('application.controller.error_members_only')
     end
@@ -128,18 +128,6 @@ class ApplicationController < ActionController::Base
     end
   end
 
-  def set_redirect_to
-    session[:redirect_to] = params[:redirect_to] if params[:redirect_to]
-  end
-
-  def back_or_default_path(default = root_path)
-    if session[:redirect_to].present?
-      default = session[:redirect_to]
-      session[:redirect_to] = nil
-    end
-    default
-  end
-
   # Always stay in foodcoop url scope
   def default_url_options(options = {})
     {foodcoop: FoodsoftConfig.scope}

app/controllers/invites_controller.rb

@@ -1,20 +1,20 @@
 class InvitesController < ApplicationController
 
-  before_filter :authenticate_membership_or_admin, :only => [:new]
-  #TODO: authorize also for create action.
+  before_filter :authenticate_membership_or_admin_for_invites
   
   def new
     @invite = Invite.new(:user => @current_user, :group => @group)
   end
   
   def create
+    authenticate_membership_or_admin params[:invite][:group_id]
     @invite = Invite.new(params[:invite])
     if @invite.save
       Mailer.invite(@invite).deliver
 
       respond_to do |format|
         format.html do
-          redirect_to back_or_default_path, notice: I18n.t('invites.success')
+          redirect_to root_path, notice: I18n.t('invites.success')
         end
         format.js { render layout: false }
       end
@@ -23,4 +23,10 @@ class InvitesController < ApplicationController
       render action: :new
     end
   end
+
+  protected
+
+  def authenticate_membership_or_admin_for_invites
+    authenticate_membership_or_admin((params[:invite][:group_id] rescue params[:id]))
+  end
 end

app/helpers/application_helper.rb

@@ -203,5 +203,5 @@ module ApplicationHelper
                                :title => I18n.t('helpers.application.write_message')
     end
   end
-
+  
 end

app/helpers/shared_helper.rb

@@ -0,0 +1,13 @@
+module SharedHelper
+
+  # provide input_html for password autocompletion
+  def autocomplete_flag_to_password_html(password_autocomplete)
+    case password_autocomplete
+      when true then {autocomplete: 'on'}
+      when false then {autocomplete: 'off'}
+      when 'store-only' then {autocomplete: 'off', data: {store: 'on'}}
+      else {}
+    end
+  end
+
+end

app/models/user.rb

@@ -73,8 +73,15 @@ class User < ActiveRecord::Base
 
   # search by (nick)name
   def self.natural_search(q)
-    # we always use both nick and name, to make sure a user is found
-    where("CONCAT(first_name, CONCAT(' ', last_name)) LIKE :q OR nick LIKE :q", q: "%#{q}%")
+    q = q.strip
+    users = User.arel_table
+    # full string as nickname
+    match_nick = users[:nick].matches("%#{q}%")
+    # or each word matches either first or last name
+    match_name = q.split.map do |a|
+        users[:first_name].matches("%#{a}%").or users[:last_name].matches("%#{a}%")
+    end.reduce(:and)
+    User.where(match_nick.or match_name)
   end
   
   def locale

app/views/admin/users/_form.html.haml

@@ -1,5 +1,5 @@
 = simple_form_for([:admin, @user]) do |f|
-  = render 'shared/user_form_fields', f: f
+  = render 'shared/user_form_fields', f: f, password_autocomplete: false
   .form-actions
     = f.submit
     = link_to t('ui.or_cancel'), :back

app/views/finance/invoices/_form.html.haml

@@ -5,7 +5,7 @@
   - if @invoice.delivery
     %p= t('finance.invoices.linked', what_link: link_to(t('finance.invoices.linked_delivery'), [@invoice.supplier,@invoice.delivery])).html_safe
   - if @invoice.order
-    %p= t('finance.invoices.linked', what_link: link_to(t('finance.invoices.linked_order'), @invoice.order)).html_safe
+    %p= t('finance.invoices.linked', what_link: link_to(t('finance.invoices.linked_order'), new_finance_order_path(order_id: @invoice.order.id))).html_safe
 
   = f.association :supplier, hint: false
   = f.input :number

app/views/home/profile.html.haml

@@ -6,7 +6,7 @@
       = h(t('.user.title', user: show_user))
       %small= t '.user.since', when: distance_of_time_in_words(Time.now, @current_user.created_on)
     = simple_form_for(@current_user, :url => update_profile_path) do |f|
-      = render :partial => 'shared/user_form_fields', :locals => {:f => f}
+      = render :partial => 'shared/user_form_fields', :locals => {:f => f, :password_autocomplete => 'store-only'}
       .form-actions
         = submit_tag t('ui.save'), class: 'btn'
   .span5

app/views/messages/new.haml

@@ -25,15 +25,15 @@
   - if FoodsoftConfig[:mailing_list].blank?
     = f.input :sent_to_all, :as => :boolean
   - else
-    %b= t '.list.desc', list: mail_to(FoodsoftConfig[:mailing_list])
+    %b= t('.list.desc', list: mail_to(FoodsoftConfig[:mailing_list])).html_safe
     %br/
     %small{:style => "color:grey"}
       = t '.list.subscribe_msg'
       %br/
       - if FoodsoftConfig[:mailing_list_subscribe].blank?
-        = t '.list.subscribe', link: link_to(t('.list.wiki'), wiki_page_path('MailingListe'))
+        = t('.list.subscribe', link: link_to(t('.list.wiki'), wiki_page_path('MailingListe'))).html_safe
       - else
-        = t '.list.mail', email: mail_to(FoodsoftConfig[:mailing_list_subscribe])
+        = t('.list.mail', email: mail_to(FoodsoftConfig[:mailing_list_subscribe])).html_safe
 
   #recipients
     = f.input :recipient_tokens, :input_html => { 'data-pre' => User.find_all_by_id(@message.recipients_ids).map(&:token_attributes).to_json }

app/views/shared/_user_form_fields.html.haml

@@ -1,12 +1,16 @@
-- if FoodsoftConfig[:use_nick]
-  -# use_nil option to user model validators break required mark
-  = f.input :nick, required: true
 = f.input :first_name
 = f.input :last_name
 = f.input :email
+-# need :required because :use_nil option on user model validators break the required mark
+= f.input :nick, required: true if FoodsoftConfig[:use_nick]
+-# You can control password autocompletion by passing `password_autocomplete` to this partial.
+-# Possible values: undefined/nil, true, false, 'store-only'
+-# see also https://github.com/foodcoops/foodsoft/wiki/Form-autocompletion
+- password_autocomplete = nil unless defined?(:password_autocomplete)
+- password_html = autocomplete_flag_to_password_html(password_autocomplete)
+= f.input :password, :required => f.object.new_record?, input_html: password_html
+= f.input :password_confirmation, :required => f.object.new_record?, input_html: password_html
 = f.input :phone
-= f.input :password, :required => f.object.new_record?
-= f.input :password_confirmation
 
 = f.simple_fields_for :settings_attributes do |s|
   = s.simple_fields_for :profile, defaults: { inline_label: true } do |profile|