Bump version to 3.12.2

sampaiodiego · sampaiodiego · commit 281d114c45eb · 2021-03-26T22:17:09.000-03:00
diff --git a/.docker/Dockerfile.rhel b/.docker/Dockerfile.rhel
@@ -1,6 +1,6 @@
 FROM registry.access.redhat.com/ubi8/nodejs-12
 
-ENV RC_VERSION 3.12.1
+ENV RC_VERSION 3.12.2
 
 MAINTAINER buildmaster@rocket.chat
 
diff --git a/.github/history-manual.json b/.github/history-manual.json
@@ -63,5 +63,21 @@
 		"contributors": [
 			"sampaiodiego"
 		]
+	}],
+	"3.12.2": [{
+		"title": "[FIX] Bump Livechat widget",
+		"userLogin": "sampaiodiego",
+		"contributors": [
+			"sampaiodiego"
+		]
+	}, {
+		"title": "[FIX] Security Hotfix (https://docs.rocket.chat/guides/security/security-updates)",
+		"userLogin": "sampaiodiego",
+		"contributors": [
+			"sampaiodiego",
+			"g-thome",
+			"KevLehman",
+			"matheusbsilva137"
+		]
 	}]
 }
diff --git a/.github/history.json b/.github/history.json
@@ -56681,6 +56681,50 @@
           ]
         }
       ]
+    },
+    "3.8.9": {
+      "node_version": "12.18.4",
+      "npm_version": "6.14.8",
+      "apps_engine_version": "1.19.0",
+      "mongo_versions": [
+        "3.4",
+        "3.6",
+        "4.0"
+      ],
+      "pull_requests": []
+    },
+    "3.10.7": {
+      "node_version": "12.18.4",
+      "npm_version": "6.14.8",
+      "apps_engine_version": "1.21.0-alpha.4235",
+      "mongo_versions": [
+        "3.4",
+        "3.6",
+        "4.0"
+      ],
+      "pull_requests": []
+    },
+    "3.11.3": {
+      "node_version": "12.18.4",
+      "npm_version": "6.14.8",
+      "apps_engine_version": "1.22.2",
+      "mongo_versions": [
+        "3.4",
+        "3.6",
+        "4.0"
+      ],
+      "pull_requests": []
+    },
+    "3.12.2": {
+      "node_version": "12.18.4",
+      "npm_version": "6.14.8",
+      "apps_engine_version": "1.23.0",
+      "mongo_versions": [
+        "3.4",
+        "3.6",
+        "4.0"
+      ],
+      "pull_requests": []
     }
   }
 }
diff --git a/.snapcraft/resources/prepareRocketChat b/.snapcraft/resources/prepareRocketChat
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-curl -SLf "https://releases.rocket.chat/3.12.1/download/" -o rocket.chat.tgz
+curl -SLf "https://releases.rocket.chat/3.12.2/download/" -o rocket.chat.tgz
 
 tar xf rocket.chat.tgz --strip 1
 
diff --git a/.snapcraft/snap/snapcraft.yaml b/.snapcraft/snap/snapcraft.yaml
@@ -7,7 +7,7 @@
 # 5.  `snapcraft snap`
 
 name: rocketchat-server
-version: 3.12.1
+version: 3.12.2
 summary: Rocket.Chat server
 description: Have your own Slack like online chat, built with Meteor. https://rocket.chat/
 confinement: strict
diff --git a/HISTORY.md b/HISTORY.md
@@ -1,4 +1,27 @@
 
+# 3.12.2
+`2021-03-26  ·  2 🐛  ·  4 👩‍💻👨‍💻`
+
+### Engine versions
+- Node: `12.18.4`
+- NPM: `6.14.8`
+- MongoDB: `3.4, 3.6, 4.0`
+- Apps-Engine: `1.23.0`
+
+### 🐛 Bug fixes
+
+
+- Bump Livechat widget
+
+- Security Hotfix (https://docs.rocket.chat/guides/security/security-updates)
+
+### 👩‍💻👨‍💻 Core Team 🤓
+
+- [@KevLehman](https://github.com/KevLehman)
+- [@g-thome](https://github.com/g-thome)
+- [@matheusbsilva137](https://github.com/matheusbsilva137)
+- [@sampaiodiego](https://github.com/sampaiodiego)
+
 # 3.12.1
 `2021-03-08  ·  1 🚀  ·  2 🐛  ·  3 👩‍💻👨‍💻`
 
diff --git a/app/api/server/v1/users.js b/app/api/server/v1/users.js
@@ -722,7 +722,8 @@ API.v1.addRoute('users.2fa.sendEmailCode', {
 		const userId = this.userId || Users[method](emailOrUsername, { fields: { _id: 1 } })?._id;
 
 		if (!userId) {
-			throw new Meteor.Error('error-invalid-user', 'Invalid user');
+			this.logger.error('[2fa] User was not found when requesting 2fa email code');
+			return API.v1.success();
 		}
 
 		emailCheck.sendEmailCode(getUserForCheck(userId));
diff --git a/app/emoji-custom/server/methods/insertOrUpdateEmoji.js b/app/emoji-custom/server/methods/insertOrUpdateEmoji.js
@@ -45,6 +45,8 @@ Meteor.methods({
 			emojiData.aliases = [];
 		}
 
+		emojiData.extension = emojiData.extension === 'svg+xml' ? 'png' : emojiData.extension;
+
 		let matchingResults = [];
 
 		if (emojiData._id) {
diff --git a/app/emoji-custom/server/methods/uploadEmojiCustom.js b/app/emoji-custom/server/methods/uploadEmojiCustom.js
@@ -1,21 +1,35 @@
 import { Meteor } from 'meteor/meteor';
 import limax from 'limax';
+import sharp from 'sharp';
 
 import { hasPermission } from '../../../authorization';
 import { RocketChatFile } from '../../../file';
 import { RocketChatFileEmojiCustomInstance } from '../startup/emoji-custom';
 import { api } from '../../../../server/sdk/api';
 
+const getFile = async (file, extension) => {
+	if (extension !== 'svg+xml') {
+		return file;
+	}
+
+	return sharp(file)
+		.png()
+		.toBuffer();
+};
+
 Meteor.methods({
-	uploadEmojiCustom(binaryContent, contentType, emojiData) {
+	async uploadEmojiCustom(binaryContent, contentType, emojiData) {
 		if (!hasPermission(this.userId, 'manage-emoji')) {
 			throw new Meteor.Error('not_authorized');
 		}
 
 		emojiData.name = limax(emojiData.name, { replacement: '_' });
 		// delete aliases for notification purposes. here, it is a string rather than an array
 		delete emojiData.aliases;
-		const file = new Buffer(binaryContent, 'binary');
+
+		const file = await getFile(Buffer.from(binaryContent, 'binary'), emojiData.extension);
+
+		emojiData.extension = emojiData.extension === 'svg+xml' ? 'png' : emojiData.extension;
 
 		const rs = RocketChatFile.bufferToStream(file);
 		RocketChatFileEmojiCustomInstance.deleteFile(encodeURIComponent(`${ emojiData.name }.${ emojiData.extension }`));
diff --git a/app/mailer/server/api.js b/app/mailer/server/api.js
@@ -8,6 +8,7 @@ import stripHtml from 'string-strip-html';
 
 import { settings } from '../../settings/server';
 import { escapeHTML } from '../../../lib/escapeHTML';
+import { replaceVariables } from './utils.js';
 
 let contentHeader;
 let contentFooter;
@@ -25,7 +26,7 @@ settings.get('Language', (key, value) => {
 });
 
 export const replacekey = (str, key, value = '') => str.replace(new RegExp(`(\\[${ key }\\]|__${ key }__)`, 'igm'), escapeHTML(value));
-export const translate = (str) => str.replace(/\{ ?([^\} ]+)(( ([^\}]+))+)? ?\}/gmi, (match, key) => TAPi18n.__(key, { lng }));
+export const translate = (str) => replaceVariables(str, (match, key) => TAPi18n.__(key, { lng }));
 export const replace = function replace(str, data = {}) {
 	if (!str) {
 		return '';
diff --git a/app/mailer/server/utils.js b/app/mailer/server/utils.js
@@ -0,0 +1 @@
+export const replaceVariables = (str, callback) => str.replace(/\{ *([^\{\} ]+)[^\{\}]*\}/gmi, callback);
diff --git a/app/mailer/tests/api.tests.js b/app/mailer/tests/api.tests.js
@@ -0,0 +1,66 @@
+/* eslint-env mocha */
+import assert from 'assert';
+
+import { replaceVariables } from '../server/utils.js';
+
+describe('Mailer-API', function() {
+	describe('translate', () => {
+		const i18n = {
+			key: 'value',
+		};
+
+		describe('single key', function functionName() {
+			it(`should be equal to test ${ i18n.key }`, () => {
+				assert.equal(`test ${ i18n.key }`, replaceVariables('test {key}', (match, key) => i18n[key]));
+			});
+		});
+
+		describe('multiple keys', function functionName() {
+			it(`should be equal to test ${ i18n.key } and ${ i18n.key }`, () => {
+				assert.equal(`test ${ i18n.key } and ${ i18n.key }`, replaceVariables('test {key} and {key}', (match, key) => i18n[key]));
+			});
+		});
+
+		describe('key with a trailing space', function functionName() {
+			it(`should be equal to test ${ i18n.key }`, () => {
+				assert.equal(`test ${ i18n.key }`, replaceVariables('test {key }', (match, key) => i18n[key]));
+			});
+		});
+
+		describe('key with a leading space', function functionName() {
+			it(`should be equal to test ${ i18n.key }`, () => {
+				assert.equal(`test ${ i18n.key }`, replaceVariables('test { key}', (match, key) => i18n[key]));
+			});
+		});
+
+		describe('key with leading and trailing spaces', function functionName() {
+			it(`should be equal to test ${ i18n.key }`, () => {
+				assert.equal(`test ${ i18n.key }`, replaceVariables('test { key }', (match, key) => i18n[key]));
+			});
+		});
+
+		describe('key with multiple words', function functionName() {
+			it(`should be equal to test ${ i18n.key }`, () => {
+				assert.equal(`test ${ i18n.key }`, replaceVariables('test {key ignore}', (match, key) => i18n[key]));
+			});
+		});
+
+		describe('key with multiple opening brackets', function functionName() {
+			it(`should be equal to test {${ i18n.key }`, () => {
+				assert.equal(`test {${ i18n.key }`, replaceVariables('test {{key}', (match, key) => i18n[key]));
+			});
+		});
+
+		describe('key with multiple closing brackets', function functionName() {
+			it(`should be equal to test ${ i18n.key }}`, () => {
+				assert.equal(`test ${ i18n.key }}`, replaceVariables('test {key}}', (match, key) => i18n[key]));
+			});
+		});
+
+		describe('key with multiple opening and closing brackets', function functionName() {
+			it(`should be equal to test {${ i18n.key }}`, () => {
+				assert.equal(`test {${ i18n.key }}`, replaceVariables('test {{key}}', (match, key) => i18n[key]));
+			});
+		});
+	});
+});
diff --git a/app/utils/rocketchat.info b/app/utils/rocketchat.info
@@ -1,3 +1,3 @@
 {
-	"version": "3.12.1"
+	"version": "3.12.2"
 }
diff --git a/ee/client/omnichannel/additionalForms/CustomFieldsAdditionalForm.js b/ee/client/omnichannel/additionalForms/CustomFieldsAdditionalForm.js
@@ -12,7 +12,13 @@ const getInitialValues = (data) => ({
 	public: !!data.public,
 });
 
-const checkInvalidOptions = (value) => value.trim() !== '' && !/^([a-zA-Z0-9-_ ]+)(,\s*[a-zA-Z0-9-_ ]+)*$/i.test(value);
+const checkInvalidOptions = (value) => {
+	if (!value || value.trim() === '') {
+		return false;
+	}
+
+	return value.split(',').every((v) => /^[a-zA-Z0-9-_ ]+$/.test(v));
+};
 
 const CustomFieldsAdditionalFormContainer = ({ data = {}, state, onChange, className }) => {
 	const t = useTranslation();
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json

Original file line number	Diff line number	Diff line change
`@@ -722,7 +722,8 @@ API.v1.addRoute('users.2fa.sendEmailCode', {`
`722`	`722`	`const userId = this.userId \|\| Users[method](emailOrUsername, { fields: { _id: 1 } })?._id;`
`723`	`723`
`724`	`724`	`if (!userId) {`
`725`		`- throw new Meteor.Error('error-invalid-user', 'Invalid user');`
	`725`	`+ this.logger.error('[2fa] User was not found when requesting 2fa email code');`
	`726`	`+ return API.v1.success();`
`726`	`727`	`}`
`727`	`728`
`728`	`729`	`emailCheck.sendEmailCode(getUserForCheck(userId));`
Original file line number	Diff line number	Diff line change
`@@ -45,6 +45,8 @@ Meteor.methods({`
`45`	`45`	`emojiData.aliases = [];`
`46`	`46`	`}`
`47`	`47`
	`48`	`+ emojiData.extension = emojiData.extension === 'svg+xml' ? 'png' : emojiData.extension;`
	`49`	`+`
`48`	`50`	`let matchingResults = [];`
`49`	`51`
`50`	`52`	`if (emojiData._id) {`