merge RT 4.2.11 and Header changes to disable RT javascript, RT#34237

6 files changed, 24 insertions, 9 deletions

diff --git a/rt/share/html/Dashboards/Elements/DashboardsForObject b/rt/share/html/Dashboards/Elements/DashboardsForObject
index 4c9df63ca..3de02161e 100644
--- a/rt/share/html/Dashboards/Elements/DashboardsForObject
+++ b/rt/share/html/Dashboards/Elements/DashboardsForObject
@@ -57,7 +57,7 @@ my $privacy = RT::Dashboard->_build_privacy($Object);
 
 while (my $attr = $Object->Attributes->Next) {
     if ($attr->Name =~ /^Dashboard\b/) {
-        my $dashboard = RT::Dashboard->new($session{'CurrentUser'});
+        my $dashboard = RT::Dashboard->new($User);
         my ($ok, $msg) = $dashboard->Load($privacy, $attr->id);
 
         if (!$ok) {
@@ -79,3 +79,7 @@ while (my $attr = $Object->Attributes->Next) {
 return \%dashboards;
 </%init>
 
+<%args>
+$User => $session{'CurrentUser'}
+</%args>
+
diff --git a/rt/share/html/Dashboards/Elements/ListOfDashboards b/rt/share/html/Dashboards/Elements/ListOfDashboards
index d6f5bccad..cc47c48eb 100644
--- a/rt/share/html/Dashboards/Elements/ListOfDashboards
+++ b/rt/share/html/Dashboards/Elements/ListOfDashboards
@@ -48,15 +48,15 @@
 <%init>
 # put the list of dashboards into the navigation
 use RT::Dashboard;
-
-my @objs = RT::Dashboard->new($session{CurrentUser})->ObjectsForLoading(
+my @objs = RT::Dashboard->new($User)->ObjectsForLoading(
                IncludeSuperuserGroups => $IncludeSuperuserGroups
            );
 
 my %dashboard_map;
 
 for my $object (@objs) {
-    my $new_dashboards = $m->comp("/Dashboards/Elements/DashboardsForObject", Object => $object);
+    my $new_dashboards = $m->comp("/Dashboards/Elements/DashboardsForObject",
+            Object => $object, User => $User );
 
     push @{ $dashboard_map{$_} }, @{ $new_dashboards->{$_} || [] }
         for qw/personal system/;
@@ -78,5 +78,6 @@ $m->callback(%ARGS, dashboards => \@dashboards, CallbackName => 'ModifyDashboard
 return @dashboards;
 </%init>
 <%args>
+$User => $session{CurrentUser}
 $IncludeSuperuserGroups => 1
 </%args>
diff --git a/rt/share/html/Dashboards/Elements/SelectPrivacy b/rt/share/html/Dashboards/Elements/SelectPrivacy
index 5628d758d..9eb276a8e 100644
--- a/rt/share/html/Dashboards/Elements/SelectPrivacy
+++ b/rt/share/html/Dashboards/Elements/SelectPrivacy
@@ -60,11 +60,11 @@ foreach my $object (@Objects) {
     if (ref($object) eq 'RT::User') {
         $label = $object->id == $session{'CurrentUser'}->Id
                     ? loc("My dashboards")
-                    : loc("[_1]'s dashboards", $m->scomp('/Elements/ShowUser', User => $object));
+                    : loc("[_1]'s dashboards", $object->Format);
     } else {
-        $label = loc("[_1]'s dashboards", $m->interp->apply_escapes($object->Name, 'h'));
+        $label = loc("[_1]'s dashboards", $object->Name);
     }
 </%perl>
-<option <%$selected|n%> value="<%$privacy%>"><% $label |n %></option>
+<option <%$selected|n%> value="<%$privacy%>"><% $label %></option>
 % }
 </select>
diff --git a/rt/share/html/Dashboards/Elements/ShowDashboards b/rt/share/html/Dashboards/Elements/ShowDashboards
index 5cf73a71d..b57867b09 100644
--- a/rt/share/html/Dashboards/Elements/ShowDashboards
+++ b/rt/share/html/Dashboards/Elements/ShowDashboards
@@ -54,6 +54,7 @@
 %   } else {
 %       $title = loc("[_1]'s dashboards",$Object->Name);
 %   }
+%   $title =~ s/([\\'])/\\$1/g;
 %   $title = $m->interp->apply_escapes($title, 'h');
 <& /Elements/CollectionList,
     %ARGS,
diff --git a/rt/share/html/Dashboards/Elements/ShowPortlet/component b/rt/share/html/Dashboards/Elements/ShowPortlet/component
index 5218843f8..3b54da21a 100644
--- a/rt/share/html/Dashboards/Elements/ShowPortlet/component
+++ b/rt/share/html/Dashboards/Elements/ShowPortlet/component
@@ -51,4 +51,14 @@ $Portlet
 $Rows => 20
 $Preview => 0
 </%args>
-% $m->comp($Portlet->{path});
+<%init>
+my $full_path = $Portlet->{path};
+(my $path = $full_path) =~ s{^/Elements/}{};
+
+my $allowed = grep { $_ eq $path } @{RT->Config->Get('HomepageComponents')};
+</%init>
+% if (!$allowed) {
+%     $m->out( $m->interp->apply_escapes( loc("Invalid portlet [_1]", $path), "h" ) );
+% } else {
+%     $m->comp($full_path);
+% }
diff --git a/rt/share/html/Dashboards/Elements/ShowPortlet/dashboard b/rt/share/html/Dashboards/Elements/ShowPortlet/dashboard
index d2ae85d5a..3c35ea891 100644
--- a/rt/share/html/Dashboards/Elements/ShowPortlet/dashboard
+++ b/rt/share/html/Dashboards/Elements/ShowPortlet/dashboard
@@ -56,7 +56,6 @@ $Depth => 0
 <%init>
 my $current_dashboard;
 
-use Scalar::Util 'blessed';
 if (blessed($Portlet) && $Portlet->isa('RT::Dashboard')) {
     $current_dashboard = $Portlet;
 }