Merge remote-tracking branch 'upstream/master'

Author: Lannro

.gitattributes

@@ -1,2 +1,3 @@
-scripts/*.min.js -diff
-scripts/*.map -diff
+/scripts/*.min.js -diff
+/scripts/*.map -diff
+/test/ldap/lldap_data/*.db -diff

.github/workflows/tests.yml

@@ -12,7 +12,7 @@ jobs:
 
     strategy:
       matrix:
-        php-versions: ['7.2', '7.3', '7.4', '8.0', '8.1', '8.2', '8.3']
+        php-versions: ['7.3', '7.4', '8.0', '8.1', '8.2', '8.3', '8.4']
 
     steps:
     - name: Checkout
@@ -43,8 +43,8 @@ jobs:
     - name: Run tests
       run: sh test/check.sh --all
 
-  build-20:
-    runs-on: ubuntu-20.04
+  build-22:
+    runs-on: ubuntu-22.04
 
     strategy:
       matrix:

.gitignore

@@ -1,18 +1,21 @@
 *~
+.DS_Store
 /Code/options.inc
 /composer.json
 /composer.lock
 /conf
 /devel/d3/d3.js
 /devel/d3/d3-hotcrp.min.js
 /devel/d3/node_modules
-/devel/d3/package-lock.json
 /devel/hotcrp-daemonize
 /docs
 /filestore
 /logs
 /node_modules
 /package-lock.json
+/test/oauth/vendor
+/test/oauth/auths.json
+/test/oauth/composer.lock
 /vendor
 .data
 .env

.htaccess

@@ -9,7 +9,7 @@
 #php_value max_input_vars 4096
 
 # A large memory_limit helps when sending very large zipped files.
-php_value memory_limit 128M
+#php_value memory_limit 128M
 
 # Default to UTF-8 (most scripts will override this with <meta>).
 AddDefaultCharset UTF-8

.phan/config.php

@@ -27,7 +27,7 @@
 return (function () {
 $config = [
     "minimum_target_php_version" => "7.2",
-    "target_php_version" => "8.3",
+    "target_php_version" => "8.4",
 
     // If true, missing properties will be created when
     // they are first seen. If false, we'll report an
@@ -72,6 +72,7 @@
     "file_list" => [
         Config::projectPath("api.php"),
         Config::projectPath("assign.php"),
+        Config::projectPath("authorize.php"),
         Config::projectPath("autoassign.php"),
         Config::projectPath("bulkassign.php"),
         Config::projectPath("buzzer.php"),
@@ -85,6 +86,7 @@
         Config::projectPath("index.php"),
         Config::projectPath("log.php"),
         Config::projectPath("mail.php"),
+        Config::projectPath("manageemail.php"),
         Config::projectPath("manualassign.php"),
         Config::projectPath("mergeaccounts.php"),
         Config::projectPath("newaccount.php"),
@@ -107,6 +109,10 @@
         Config::projectPath("lib/polyfills.php")
     ],
 
+    "exclude_analysis_directory_list" => [
+        Config::projectPath("test/oauth")
+    ],
+
     "suppress_issue_types" => [
         "PhanUnusedPublicMethodParameter",
         "PhanUnusedVariableValueOfForeachWithKey",

.travis.yml

@@ -9,4 +9,4 @@
 ;max_input_vars = 4096
 
 ; A large memory_limit helps when sending very large zipped files.
-memory_limit = 128M
+;memory_limit = 128M

.user.ini

@@ -1,13 +1,120 @@
 HotCRP NEWS
 ===========
 
+## Version 3.1 – 12.Sep.2025
+
+* Upgrade notes
+
+    * PHP 8.4 is supported, PHP 7.2 is not.
+    * The `oAuthTypes` setting is no longer understood.
+    * The `oAuthTypes` `group_mappings` subsetting is replaced by
+      `group_roles`.
+    * Previous versions of the `batch/backupdb.php` script could produce
+      invalid backups in the case that the database contained large documents.
+
+* Accounts
+
+    * Replace “merge accounts” functionality with “Manage email”. Manage email
+      allows transferring reviews and linking accounts, where the primary
+      linked account redirects review requests and receives shared authorship.
+    * OAuth can import group affiliations and roles (Tobias Fiebig).
+    * Expose ORCID iD and country in user lists and downloads.
+    * Profile supports reauthentication more cleanly.
+    * Improve LDAP support.
+    * Add support for extension tracks. For instance, the `settings!`
+      extension track defines who can modify settings.
+
+* Search
+
+    * Improve named search UI; expose highlighted searches.
+    * Add support for dot tag patterns (for instance, tag `#dot-rgb-ffff00`
+      adds bright yellow dots).
+    * Systematize view options.
+    * Add `cmtafter:DATE` search term.
+    * Treat some Unicode spaces like normal spaces in parsing.
+    * Fix searches within specific response rounds.
+
+* Assignments
+
+    * The autoassigner can run as a background job, supporting longer
+      processing times.
+    * Fix bug where “bad pairs” were misparsed by the autoassigner.
+    * Bulk assignments supports upload of very large assignment files.
+    * Improve handling of assignment files that generate large numbers of
+      errors.
+    * Assigner messages about potential conflicts include buttons for
+      immediately confirming or ignoring each conflict.
+    * The `copytag` and `newtag` assigners can move all matching tags (for
+      instance, set `tag` to `my*` and `newtag` to `renamed-*`).
+    * Improve UI display of large PC sets in conflict editing and review
+      assignment pages.
+
+* Submissions
+
+    * Improve handling of complex field conditions: avoid crashes.
+    * Support fields with edit conditions that depend on other fields with
+      edit conditions.
+    * Introduce author certification submission field type.
+
+* Reviews
+
+    * Review preferences page supports shuffled preferences via
+      `sort:shuffle`.
+    * Preference fuzzing can group preferences into bands to reduce the impact
+      of collusion.
+    * Assign review IDs randomly.
+    * Improve handling of field names with no ASCII characters.
+    * Administrators can clear all review ratings.
+    * Detect conflicts when saving a review that’s been concurrently updated
+      in another tab.
+
+* Comments
+
+    * Refer to comment “threads” rather than topics; update thread UI.
+    * Don’t expose identities of past shepherds.
+    * Fix bugs where @mentions were not always reset.
+    * Fix bug where @mentioned user might receive multiple emails for a single
+      comment.
+    * @Mentions of the current user are highlighted.
+    * Censor comment display in more cases: @mentioned users are anonymized to
+      comment viewers who can’t see the relevant identities.
+    * Add setting that allows authors to initiate comment exchanges.
+    * Add separate track permission for commenting.
+
+* Formulas
+
+    * Checkbox review fields can be used in formulas.
+    * Improve graph displays.
+    * Support `pagecount`.
+
+* API
+
+    * Begin stabilizing and documenting API.
+    * Reduce opportunities to enumerate users through the API.
+    * Add `reviewhistory` API call.
+
+* Mail
+
+    * Prefer `{{TEMPLATE}}` style to `%TEMPLATE%`.
+    * Add site URL to mail signatures.
+    * Better handle thousands of emails.
+
+* Batch scripts
+
+    * Settings can be filtered by tag.
+    * Add `batch/actionlog.php` script.
+    * Add `batch/hotcrapi.php` script for contacting HotCRP APIs.
+
+* Many other bug fixes and improvements.
+
+
 ## Version 3.0.0 – 14.Mar.2024
 
 * Upgrade notes
 
     * PHP 8.2 and 8.3 are supported, PHP 7.0 and 7.1 are not.
     * Remove support for `#perm` tags.
-    * Prefer `$Opt["oAuthProviders"]` (not `$Opt["oAuthTypes"]`).
+    * Prefer `$Opt["oAuthProviders"]` (deprecate `$Opt["oAuthTypes"]`).
 
 * Batch scripts