rdmorganiser · MyPyDavid · Apr 28, 2025 · Apr 28, 2025 · Apr 28, 2025 · Apr 28, 2025
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -29,10 +29,6 @@ env:
 
 jobs:
 
-  lint:
-    # Ref: https://github.com/rdmorganiser/.github/blob/main/.github/workflows/_lint.yml
-    uses: rdmorganiser/.github/.github/workflows/_lint.yml@main
-
   build-wheel:
     name: Build python wheel
     runs-on: ubuntu-24.04
@@ -282,7 +278,6 @@ jobs:
   required-checks-pass:
     if: always()
     needs:
-      - lint
       - build-wheel
       - test
       - coveralls

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -22,12 +22,12 @@ repos:
         exclude: \.dot$
       - id: debug-statements
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.9.9
+    rev: v0.11.8
     hooks:
       - id: ruff
         args: [--fix, --exit-non-zero-on-fix]
   - repo: https://github.com/pre-commit/mirrors-eslint
-    rev: v9.21.0
+    rev: v9.26.0
     hooks:
       - id: eslint
         args: [--fix, --color]
@@ -36,7 +36,7 @@ repos:
           - eslint-plugin-react@7.37.0
           - react@18.3.1
   - repo: https://github.com/crate-ci/typos
-    rev: v1.30.0
+    rev: v1
     hooks:
     - id: typos
       exclude: |

diff --git a/README.md b/README.md
@@ -5,7 +5,6 @@ RDMO - Research Data Management Organiser
 [![Python Versions](https://img.shields.io/pypi/pyversions/rdmo.svg?style=flat)](https://www.python.org/)
 [![Django Versions](https://img.shields.io/pypi/frameworkversions/django/rdmo)](https://pypi.python.org/pypi/rdmo/)
 [![License](https://img.shields.io/github/license/rdmorganiser/rdmo?style=flat)](https://github.com/rdmorganiser/rdmo/blob/main/LICENSE) \
-[![pre-commit](https://img.shields.io/badge/pre--commit-enabled-brightgreen?logo=pre-commit&logoColor=white)](https://github.com/pre-commit/pre-commit)
 [![pre-commit.ci status](https://results.pre-commit.ci/badge/github/rdmorganiser/rdmo/main.svg)](https://results.pre-commit.ci/latest/github/rdmorganiser/rdmo/main)
 [![Ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
 [![CI Workflow Status](https://github.com/rdmorganiser/rdmo/actions/workflows/ci.yml/badge.svg)](https://github.com/rdmorganiser/rdmo/actions/workflows/ci.yml)

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -27,36 +27,36 @@
     "lodash": "^4.17.21",
     "popper.js": "^1.16.1",
     "prop-types": "^15.7.2",
-    "react": "^18.3.1",
+    "react": "^19.0.0",
     "react-bootstrap": "0.33.1",
-    "react-datepicker": "7.5.0",
-    "react-diff-viewer-continued": "^3.4.0",
+    "react-datepicker": "8.0.0",
+    "react-diff-viewer-continued": "^4.0.5",
     "react-dnd": "^16.0.1",
     "react-dnd-html5-backend": "^16.0.1",
-    "react-dom": "^18.3.1",
-    "react-dropzone": "^14.2.3",
-    "react-redux": "^8.1.3",
-    "react-select": "^5.8.0",
-    "redux": "^4.1.1",
+    "react-dom": "^19.0.0",
+    "react-dropzone": "^14.3.5",
+    "react-redux": "^9.2.0",
+    "react-select": "^5.10.0",
+    "redux": "^5.0.1",
     "redux-logger": "^3.0.6",
-    "redux-thunk": "^2.3.0",
+    "redux-thunk": "^3.1.0",
     "use-debounce": "^10.0.0"
   },
   "devDependencies": {
     "@babel/cli": "^7.27.0",
-    "@babel/core": "^7.26.0",
-    "@babel/preset-env": "^7.26.0",
-    "@babel/preset-react": "^7.26.3",
+    "@babel/core": "^7.27.1",
+    "@babel/preset-env": "^7.27.1",
+    "@babel/preset-react": "^7.27.1",
     "babel-loader": "^10.0.0",
     "copy-webpack-plugin": "^13.0.0",
     "css-loader": "^7.1.1",
     "eslint": "~8.56.0",
     "eslint-plugin-react": "^7.37.2",
     "file-loader": "^6.2.0",
     "mini-css-extract-plugin": "^2.9.0",
-    "sass": "^1.86.2",
+    "sass": "^1.87.0",
     "sass-loader": "^16.0.0",
-    "webpack": "^5.98.0",
+    "webpack": "^5.99.7",
     "webpack-cli": "^6.0.1",
     "webpack-merge": "6.0.1"
   }

diff --git a/pyproject.toml b/pyproject.toml
@@ -45,7 +45,7 @@ dependencies = [
   "django>=4.2,<5.0",
   "django-cleanup>=8.0,<10.0",
   "django-compressor>=4.4,<5.0",
-  "django-extensions>=3.2,<4.0",
+  "django-extensions>=3.2,<5.0",
   "django-filter>=23.2,<26.0",
   "django-libsass>=0.9,<1.0",
   "django-mathfilters>=1.0,<2.0",
@@ -57,7 +57,7 @@ dependencies = [
   "drf-extensions>=0.7.1,<1.0",
   "iso8601>=2.0,<3.0",
   "markdown>=3.4,<4.0",
-  "packaging>=23.2,<25.0",
+  "packaging>=23.2,<26.0",
   "pypandoc>=1.11,<2.0",
   "requests-toolbelt>=1.0,<2.0",
   "rules>=3.4,<4.0",
@@ -75,7 +75,7 @@ dev = [
   "build>=1.0,<2.0",
   "pipdeptree>=2.13,<3.0",
   "pre-commit>=3.4,<5.0",
-  "setuptools>=73,<79",
+  "setuptools>=73,<81",
   "twine>=5.1.1,<7.0",
   "wheel>=0.42,<0.46",
   "rdmo[allauth,openapi,pytest]",

diff --git a/rdmo/conditions/migrations/0025_alter_condition_uri_path.py b/rdmo/conditions/migrations/0025_alter_condition_uri_path.py
@@ -0,0 +1,18 @@
+# Generated by Django 4.2.20 on 2025-04-28 12:14
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('conditions', '0024_uri_path'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='condition',
+            name='uri_path',
+            field=models.CharField(blank=True, default='', help_text='The path for the URI of this condition.', max_length=512, verbose_name='URI Path'),
+        ),
+    ]
diff --git a/rdmo/conditions/models.py b/rdmo/conditions/models.py
@@ -40,8 +40,8 @@ class Condition(models.Model):
         verbose_name=_('URI Prefix'),
         help_text=_('The prefix for the URI of this condition.')
     )
-    uri_path = models.SlugField(
-        max_length=512, blank=True,
+    uri_path = models.CharField(
+        max_length=512, blank=True, default="",
         verbose_name=_('URI Path'),
         help_text=_('The path for the URI of this condition.')
     )

diff --git a/rdmo/core/assets/js/utils/config.js b/rdmo/core/assets/js/utils/config.js
@@ -30,10 +30,13 @@ const deleteConfigInLocalStorage = (prefix, path) => {
   localStorage.removeItem(`${prefix}.${path}`)
 }
 
+const isTruthy = (value) => [true, 'true'].includes(value)
+
 export {
   updateConfig,
   deleteConfig,
   getConfigFromLocalStorage,
   setConfigInLocalStorage,
-  deleteConfigInLocalStorage
+  deleteConfigInLocalStorage,
+  isTruthy
 }
diff --git a/rdmo/core/imports.py b/rdmo/core/imports.py
@@ -48,7 +48,7 @@ def handle_fetched_file(filedata):
 
 
 def generate_tempfile_name():
-    t = int(round(time.time() * 1000))
+    t = round(time.time() * 1000)
     r = randint(10000, 99999)
     fn = pj(tempfile.gettempdir(), 'upload_' + str(t) + '_' + str(r) + '.xml')
     return fn

diff --git a/rdmo/core/pandoc.py b/rdmo/core/pandoc.py
@@ -108,8 +108,10 @@ def get_pandoc_reference_document(export_format, context):
 
     # return the first reference document that actually exists
     for reference_document in reference_documents:
-        if reference_document and reference_document.exists():
-            return Path(reference_document)
+        if reference_document:
+            reference_document = Path(reference_document).resolve()
+            if reference_document.exists():
+                return reference_document
 
 
 def get_pandoc_reference_documents(export_format, context):

diff --git a/rdmo/core/settings.py b/rdmo/core/settings.py
@@ -111,7 +111,7 @@
     'signup': 'rdmo.accounts.account.SignupForm'
 }
 ACCOUNT_USER_DISPLAY = 'rdmo.accounts.utils.get_full_name'
-ACCOUNT_EMAIL_REQUIRED = True
+ACCOUNT_SIGNUP_FIELDS = ['username*', 'email*', 'password1*', 'password2*']
 ACCOUNT_ACTIVATION_DAYS = 7
 ACCOUNT_EMAIL_CONFIRMATION_EXPIRE_DAYS = 7
 ACCOUNT_EMAIL_VERIFICATION = 'optional'

diff --git a/rdmo/core/templatetags/core_tags.py b/rdmo/core/templatetags/core_tags.py
@@ -11,7 +11,7 @@
 from django.utils.translation import get_language, to_locale
 
 from rdmo import __version__
-from rdmo.core.utils import markdown2html
+from rdmo.core.utils import markdown2html, remove_html_special_characters
 
 register = template.Library()
 
@@ -132,3 +132,9 @@ def startswith(text, starts):
     if isinstance(text, str):
         return text.startswith(starts)
     return False
+
+
+@register.filter()
+@stringfilter
+def clean(string):
+    return remove_html_special_characters(string)
diff --git a/rdmo/core/tests/test_openapi.py b/rdmo/core/tests/test_openapi.py
@@ -21,7 +21,7 @@ def test_openapi_schema(db, client, login, settings, username):
         assert response.status_code == 200
         schema = yaml.safe_load(response.content)
         assert schema['openapi'] == '3.0.3'
-        assert len(schema['paths']) == 123
+        assert len(schema['paths']) == 124
     else:
         assert response.status_code == 302
 

diff --git a/rdmo/core/utils.py b/rdmo/core/utils.py
@@ -302,6 +302,10 @@ def remove_double_newlines(string):
     return re.sub(r'[\n]{2,}', '\n\n', string)
 
 
+def remove_html_special_characters(string):
+    return re.sub(r'[<>&"\']', '', string)
+
+
 def parse_date_from_string(date: str) -> datetime.date:
     if not isinstance(date, str):
         raise TypeError("date must be provided as string")

diff --git a/rdmo/core/views.py b/rdmo/core/views.py
@@ -67,6 +67,7 @@ def api(request):
                 'core',
                 'domain',
                 'management',
+                'options',
                 'overlays',
                 'projects',
                 'questions',
@@ -117,7 +118,15 @@ class StoreIdViewMixin(View):
 
     def render_to_response(self, context, **response_kwargs):
         response = super().render_to_response(context, **response_kwargs)
-        response.set_cookie('storeid', self.get_store_id(), samesite='Lax')
+        response.set_cookie(
+            'storeid',
+            self.get_store_id(),
+            path=settings.SESSION_COOKIE_PATH,
+            domain=settings.SESSION_COOKIE_DOMAIN,
+            secure=settings.SESSION_COOKIE_SECURE,
+            httponly=False,
+            samesite=settings.SESSION_COOKIE_SAMESITE,
+        )
         return response
 
     def get_store_id(self):

diff --git a/rdmo/locale/de/LC_MESSAGES/django.mo b/rdmo/locale/de/LC_MESSAGES/django.mo
diff --git a/rdmo/locale/de/LC_MESSAGES/django.po b/rdmo/locale/de/LC_MESSAGES/django.po
@@ -2,8 +2,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: RDMO\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2025-04-10 10:54+0200\n"
-"PO-Revision-Date: 2025-04-10 10:59+0200\n"
+"POT-Creation-Date: 2025-04-28 13:45+0200\n"
+"PO-Revision-Date: 2025-04-28 13:46+0200\n"
 "Last-Translator: Jochen Klar <jklar@aip.de>\n"
 "Language-Team: RDMO <rdmo-team@listserv.dfn.de>\n"
 "Language: de\n"
@@ -2369,15 +2369,18 @@ msgstr "Sichtbarkeiten"
 
 #: projects/models/visibility.py:50
 #, python-format
-msgid "This project can be accessed by all users on %s and in the group %s."
+msgid ""
+"This project can be accessed by all users on %(sites)s and in the group "
+"%(groups)s."
 msgid_plural ""
-"This project can be accessed by all users on %s and in the groups %s."
+"This project can be accessed by all users on %(sites)s and in the groups "
+"%(groups)s."
 msgstr[0] ""
-"Auf dieses Projekt können alle Nutzenden auf %s oder in der Gruppe %s "
-"zugreifen."
+"Auf dieses Projekt können alle Nutzenden auf %(sites)s oder in der Gruppe "
+"%(groups)s zugreifen."
 msgstr[1] ""
-"Dieses Projekt kann von allen Nutzenden auf %s oder in den Gruppen %s "
-"aufgerufen werden."
+"Dieses Projekt kann von allen Nutzenden auf %(sites)s oder in den Gruppen "
+"%(groups)s aufgerufen werden."
 
 #: projects/models/visibility.py:58
 #, python-format

diff --git a/rdmo/locale/de/LC_MESSAGES/djangojs.mo b/rdmo/locale/de/LC_MESSAGES/djangojs.mo
diff --git a/rdmo/locale/de/LC_MESSAGES/djangojs.po b/rdmo/locale/de/LC_MESSAGES/djangojs.po
@@ -2,8 +2,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: RDMO\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2025-03-20 09:38+0100\n"
-"PO-Revision-Date: 2025-03-20 09:44+0100\n"
+"POT-Creation-Date: 2025-04-28 13:42+0200\n"
+"PO-Revision-Date: 2025-04-28 13:43+0200\n"
 "Last-Translator: Jochen Klar <jklar@aip.de>\n"
 "Language-Team: RDMO <rdmo-team@listserv.dfn.de>\n"
 "Language: de\n"
@@ -1878,6 +1878,18 @@ msgstr "Meine Projekte"
 msgid "All projects"
 msgstr "Alle Projekte"
 
+#: projects/assets/js/projects/components/main/Projects.js:55
+msgid "Copy project"
+msgstr "Projekt kopieren"
+
+#: projects/assets/js/projects/components/main/Projects.js:56
+msgid "Update project"
+msgstr "Projekt bearbeiten"
+
+#: projects/assets/js/projects/components/main/Projects.js:57
+msgid "Delete project"
+msgstr "Projekt entfernen"
+
 #: projects/assets/js/projects/utils/constants.js:4
 msgid "Name"
 msgstr "Name"

diff --git a/rdmo/management/assets/js/actions/elementActions.js b/rdmo/management/assets/js/actions/elementActions.js
@@ -2,6 +2,7 @@ import { get, isNil } from 'lodash'
 
 import { addToPending, removeFromPending } from 'rdmo/core/assets/js/actions/pendingActions'
 import { updateConfig } from 'rdmo/core/assets/js/actions/configActions'
+import { siteId } from 'rdmo/core/assets/js/utils/meta'
 
 import ConditionsApi from '../api/ConditionsApi'
 import DomainApi from '../api/DomainApi'
@@ -347,14 +348,14 @@ export function fetchElement(elementType, elementId, elementAction=null) {
     return dispatch(action)
       .then(elements => {
         if (elementAction == 'copy') {
-          const { settings, currentSite } = getState().config
+          const { settings } = getState().config
 
           elements.element.id = null
           elements.element.read_only = false
 
           if (settings.multisite) {
-            elements.element.sites = [currentSite.id]
-            elements.element.editors = [currentSite.id]
+            elements.element.sites = [siteId]
+            elements.element.editors = [siteId]
           }
         }
         return dispatch(fetchElementSuccess({ ...elements }))

diff --git a/rdmo/management/tests/e2e/conftest.py b/rdmo/management/tests/e2e/conftest.py
@@ -1,5 +1,6 @@
 import pytest
 
+from _pytest.fixtures import SubRequest
 from playwright.sync_api import Page
 
 from rdmo.core.tests.e2e.conftest import (  # noqa: F401
@@ -21,7 +22,7 @@ def e2e_username(scope="session") -> str:
 
 
 @pytest.fixture
-def page(django_db_setup, live_server, browser, authenticated_page: Page) -> Page:  # noqa: F811
+def page_single(django_db_setup, live_server, browser, authenticated_page: Page) -> Page:  # noqa: F811
     """Navigates the authenticated page to /management."""
     authenticated_page.goto("/management")  # Navigate to the projects section
     authenticated_page.wait_for_load_state()  # maybe not needed
@@ -35,3 +36,15 @@ def page_multisite(django_db_setup, live_server, browser, authenticated_page: Pa
     authenticated_page.goto("/management")  # Navigate to the projects section
     authenticated_page.wait_for_load_state()  # maybe not needed
     return authenticated_page
+
+
+@pytest.fixture
+def page(request, django_db_setup, authenticated_page) -> Page:  # noqa: F811
+    """Allows for the specific page fixtures to be parameters and returns a default fixture for page"""
+    try:
+        return request.getfixturevalue(request.param)
+    except AttributeError as e:
+        if isinstance(request, SubRequest) and request.fixturename == "page":
+            # set a default return fixture for "page"
+            return request.getfixturevalue("page_multisite")
+        raise e from e