Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
55 commits
Select commit Hold shift + click to select a range
767c1b8
upgrade deps (bp6)
gabrielburnworth Jun 26, 2025
bba871d
clear parcel assets before building
gabrielburnworth Jun 27, 2025
761eb61
Merge branch 'main' of https://github.com/FarmBot/Farmbot-Web-App int…
gabrielburnworth Jun 27, 2025
ccc4559
fix csp_reports error
gabrielburnworth Jun 29, 2025
0ace718
add commit SHAs to release info
gabrielburnworth Jun 30, 2025
d668a84
upgrade deps (postgres:17)
gabrielburnworth Jun 30, 2025
b16ef34
add menu configs and sun angle debugger
gabrielburnworth Jun 30, 2025
6f7eeeb
add demo account lua runner
gabrielburnworth Jul 3, 2025
e79a158
add more demo account bot controls
gabrielburnworth Jul 3, 2025
3d50b2f
add estop and helpers to lua runner
gabrielburnworth Jul 9, 2025
0f0539f
add more to and refactor lua runner
gabrielburnworth Jul 11, 2025
2870de2
upgrade deps
gabrielburnworth Jul 11, 2025
e6d5ea7
improve 3D and demo account tool handling
gabrielburnworth Jul 12, 2025
e9ab867
add move and execute to lua runner
gabrielburnworth Jul 16, 2025
dc6e730
support queueing and track call depth in lua runner
gabrielburnworth Jul 16, 2025
07dceb8
add point group loops and safe z to demo accounts
gabrielburnworth Jul 17, 2025
3163ffb
add warnings, flowrate, bugfixes, and points to demo accounts
gabrielburnworth Jul 19, 2025
87ee6cc
support demo sequence scope declarations
gabrielburnworth Jul 19, 2025
64c91c9
improve watering animation
gabrielburnworth Jul 19, 2025
3ff065c
add axis_order
gabrielburnworth Jul 24, 2025
ebad9c6
add seeder_tip_z_offset
gabrielburnworth Jul 24, 2025
f889139
fix lua runner move helper
gabrielburnworth Jul 25, 2025
3a8e1d6
change move axis_order to grouping and route
gabrielburnworth Jul 29, 2025
ada920d
fix watering animation
gabrielburnworth Jul 31, 2025
4f48caa
add dev settings and fix inactive color
gabrielburnworth Jul 31, 2025
06c716b
move calculate move code
gabrielburnworth Jul 31, 2025
175db8f
add demo account logging
gabrielburnworth Jul 31, 2025
71b624b
upgrade deps (ruby)
gabrielburnworth Aug 2, 2025
1d6f702
add default axis order setting
gabrielburnworth Aug 2, 2025
f2f8d90
eslint-ignore problem file
gabrielburnworth Aug 2, 2025
92bfa11
use correct tooltip
gabrielburnworth Aug 12, 2025
9fab685
add 3D sequence visualization and fix demo trough movements
gabrielburnworth Aug 13, 2025
001ad26
handle JSON errors
gabrielburnworth Aug 13, 2025
20723fd
sequence editor styling improvements
roryaronson Aug 15, 2025
394786c
improve nav popup tabs
roryaronson Aug 15, 2025
8830e81
better icon button active states
roryaronson Aug 15, 2025
4eef26f
update seeded sequences and demo account lua runner
gabrielburnworth Aug 15, 2025
3fc462e
add filtering to get_point lua runner functions
gabrielburnworth Aug 19, 2025
bca2f6d
add new slot setup steps
gabrielburnworth Aug 20, 2025
cc15858
shorten water job name
gabrielburnworth Aug 20, 2025
e922aed
upgrade deps
gabrielburnworth Aug 20, 2025
bd64d8e
add max_auto_reruns to ci config
gabrielburnworth Aug 20, 2025
739b70b
handle ai error messages
gabrielburnworth Aug 22, 2025
cbc9f96
increase spinach demo water amount
gabrielburnworth Aug 22, 2025
f0b7e8b
show v1.8 seed option during setup
gabrielburnworth Aug 22, 2025
aa96c7c
better align wizard slot components
roryaronson Aug 23, 2025
61f78b4
add is_demo lua helper
gabrielburnworth Aug 26, 2025
692b29d
adjust job css and nav order
gabrielburnworth Aug 29, 2025
e73ff80
add toolslot tool dropdowns to setup wizard
gabrielburnworth Aug 30, 2025
2bf6d46
remove v1.8 feature wall
gabrielburnworth Sep 2, 2025
1640488
upgrade deps
gabrielburnworth Sep 2, 2025
a62b828
allow viewing of os download table on mobile
gabrielburnworth Sep 2, 2025
50ac600
setup wizard slot assignment alignment
roryaronson Sep 3, 2025
909e1c2
beacon highlight improvement
roryaronson Sep 3, 2025
c53ef0e
fix motor load indicator position
gabrielburnworth Sep 3, 2025
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .circleci/config.yml
Original file line number Diff line number Diff line change
Expand Up @@ -115,6 +115,7 @@ commands:
workflows:
version: 2
build_and_test:
max_auto_reruns: 1
jobs:
#- build
- all
Expand Down
1 change: 1 addition & 0 deletions .eslintignore
Original file line number Diff line number Diff line change
@@ -1,2 +1,3 @@
hacks.d.ts
.eslintrc.js
frontend/wizard/step.tsx
2 changes: 1 addition & 1 deletion .ruby-version
Original file line number Diff line number Diff line change
@@ -1 +1 @@
3.4.4
3.4.5
3 changes: 2 additions & 1 deletion Gemfile
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
source "https://rubygems.org"
ruby "~> 3.4.4"
ruby "~> 3.4.5"

gem "rails", "~> 6"
gem "active_model_serializers"
Expand Down Expand Up @@ -32,6 +32,7 @@ gem "drb"
gem "benchmark"
gem "ostruct"
gem "bigdecimal"
gem "mutex_m"

group :development, :test do
gem "climate_control"
Expand Down
98 changes: 49 additions & 49 deletions Gemfile.lock
Original file line number Diff line number Diff line change
Expand Up @@ -68,10 +68,10 @@ GEM
addressable (2.8.7)
public_suffix (>= 2.0.2, < 7.0)
amq-protocol (2.3.4)
base64 (0.2.0)
base64 (0.3.0)
bcrypt (3.1.20)
benchmark (0.4.0)
bigdecimal (3.1.9)
benchmark (0.4.1)
bigdecimal (3.2.2)
builder (3.3.0)
bunny (2.24.0)
amq-protocol (~> 2.3)
Expand All @@ -87,9 +87,9 @@ GEM
crass (1.0.6)
database_cleaner (2.1.0)
database_cleaner-active_record (>= 2, < 3)
database_cleaner-active_record (2.2.1)
database_cleaner-active_record (2.2.2)
activerecord (>= 5.a)
database_cleaner-core (~> 2.0.0)
database_cleaner-core (~> 2.0)
database_cleaner-core (2.0.1)
date (3.4.1)
declarative (0.0.20)
Expand All @@ -113,34 +113,34 @@ GEM
drb (2.2.3)
e2mmap (0.1.0)
erubi (1.13.1)
factory_bot (6.5.1)
factory_bot (6.5.5)
activesupport (>= 6.1.0)
factory_bot_rails (6.4.4)
factory_bot_rails (6.5.0)
factory_bot (~> 6.5)
railties (>= 5.0.0)
faker (3.5.1)
railties (>= 6.1.0)
faker (3.5.2)
i18n (>= 1.8.11, < 2)
faraday (2.13.1)
faraday (2.13.4)
faraday-net_http (>= 2.0, < 3.5)
json
logger
faraday-follow_redirects (0.3.0)
faraday (>= 1, < 3)
faraday-net_http (3.4.0)
faraday-net_http (3.4.1)
net-http (>= 0.5.0)
globalid (1.2.1)
activesupport (>= 6.1)
google-apis-core (0.18.0)
addressable (~> 2.5, >= 2.5.1)
googleauth (~> 1.9)
httpclient (>= 2.8.3, < 3.a)
mini_mime (~> 1.0)
mutex_m
google-apis-core (1.0.1)
addressable (~> 2.8, >= 2.8.7)
faraday (~> 2.13)
faraday-follow_redirects (~> 0.3)
googleauth (~> 1.14)
mini_mime (~> 1.1)
representable (~> 3.0)
retriable (>= 2.0, < 4.a)
retriable (~> 3.1)
google-apis-iamcredentials_v1 (0.24.0)
google-apis-core (>= 0.15.0, < 2.a)
google-apis-storage_v1 (0.51.0)
google-apis-storage_v1 (0.56.0)
google-apis-core (>= 0.15.0, < 2.a)
google-cloud-core (1.8.0)
google-cloud-env (>= 1.0, < 3.a)
Expand All @@ -149,33 +149,31 @@ GEM
base64 (~> 0.2)
faraday (>= 1.0, < 3.a)
google-cloud-errors (1.5.0)
google-cloud-storage (1.56.0)
google-cloud-storage (1.57.0)
addressable (~> 2.8)
digest-crc (~> 0.4)
google-apis-core (~> 0.13)
google-apis-core (>= 0.18, < 2)
google-apis-iamcredentials_v1 (~> 0.18)
google-apis-storage_v1 (>= 0.42)
google-cloud-core (~> 1.6)
googleauth (~> 1.9)
mini_mime (~> 1.0)
google-logging-utils (0.2.0)
googleauth (1.14.0)
googleauth (1.15.0)
faraday (>= 1.0, < 3.a)
google-cloud-env (~> 2.2)
google-logging-utils (~> 0.1)
jwt (>= 1.4, < 3.0)
jwt (>= 1.4, < 4.0)
multi_json (~> 1.11)
os (>= 0.9, < 2.0)
signet (>= 0.16, < 2.a)
hashdiff (1.2.0)
hashie (4.1.0)
httpclient (2.9.0)
mutex_m
i18n (1.14.7)
concurrent-ruby (~> 1.0)
json (2.12.2)
json (2.13.2)
jsonapi-renderer (0.2.2)
jwt (2.10.1)
jwt (3.1.2)
base64
kaminari (1.2.2)
activesupport (>= 4.1.0)
Expand Down Expand Up @@ -207,13 +205,13 @@ GEM
method_source (1.1.0)
mini_mime (1.1.5)
minitest (5.25.5)
multi_json (1.15.0)
multi_json (1.17.0)
mutations (0.9.1)
activesupport
mutex_m (0.3.0)
net-http (0.6.0)
uri
net-imap (0.5.8)
net-imap (0.5.10)
date
net-protocol
net-pop (0.1.2)
Expand All @@ -223,18 +221,19 @@ GEM
net-smtp (0.5.1)
net-protocol
nio4r (2.7.4)
nokogiri (1.18.8-aarch64-linux-gnu)
nokogiri (1.18.9-aarch64-linux-gnu)
racc (~> 1.4)
nokogiri (1.18.8-x86_64-linux-gnu)
nokogiri (1.18.9-x86_64-linux-gnu)
racc (~> 1.4)
orm_adapter (0.5.0)
os (1.1.4)
ostruct (0.6.1)
ostruct (0.6.3)
passenger (6.0.27)
rack (>= 1.6.13)
rackup (>= 1.0.1)
rake (>= 12.3.3)
pg (1.5.9)
pg (1.6.2-aarch64-linux)
pg (1.6.2-x86_64-linux)
pry (0.15.2)
coderay (~> 1.1)
method_source (~> 1.0)
Expand All @@ -248,7 +247,7 @@ GEM
hashie (~> 4.1)
multi_json (~> 1.15)
racc (1.8.1)
rack (2.2.16)
rack (2.2.17)
rack-attack (6.7.0)
rack (>= 1.0, < 4)
rack-cors (2.0.2)
Expand Down Expand Up @@ -291,7 +290,7 @@ GEM
method_source
rake (>= 12.2)
thor (~> 1.0)
rake (13.2.1)
rake (13.3.0)
rbtree (0.4.6)
redis (4.8.1)
representable (3.2.0)
Expand All @@ -304,18 +303,18 @@ GEM
actionpack (>= 5.2)
railties (>= 5.2)
retriable (3.1.2)
rexml (3.4.1)
rexml (3.4.2)
rollbar (3.6.2)
rspec (3.13.0)
rspec (3.13.1)
rspec-core (~> 3.13.0)
rspec-expectations (~> 3.13.0)
rspec-mocks (~> 3.13.0)
rspec-core (3.13.3)
rspec-core (3.13.5)
rspec-support (~> 3.13.0)
rspec-expectations (3.13.4)
rspec-expectations (3.13.5)
diff-lcs (>= 1.2.0, < 2.0)
rspec-support (~> 3.13.0)
rspec-mocks (3.13.4)
rspec-mocks (3.13.5)
diff-lcs (>= 1.2.0, < 2.0)
rspec-support (~> 3.13.0)
rspec-rails (6.1.5)
Expand All @@ -326,27 +325,27 @@ GEM
rspec-expectations (~> 3.13)
rspec-mocks (~> 3.13)
rspec-support (~> 3.13)
rspec-support (3.13.3)
rspec-support (3.13.5)
rspec_junit_formatter (0.6.0)
rspec-core (>= 2, < 4, != 2.12.0)
scenic (1.8.0)
scenic (1.9.0)
activerecord (>= 4.0.0)
railties (>= 4.0.0)
secure_headers (7.1.0)
set (1.1.2)
signet (0.20.0)
signet (0.21.0)
addressable (~> 2.8)
faraday (>= 0.17.5, < 3.a)
jwt (>= 1.5, < 3.0)
jwt (>= 1.5, < 4.0)
multi_json (~> 1.10)
simplecov (0.22.0)
docile (~> 1.1)
simplecov-html (~> 0.11)
simplecov_json_formatter (~> 0.1)
simplecov-cobertura (2.1.0)
simplecov-cobertura (3.1.0)
rexml
simplecov (~> 0.19)
simplecov-html (0.13.1)
simplecov-html (0.13.2)
simplecov_json_formatter (0.1.4)
sorted_set (1.0.3)
rbtree
Expand All @@ -359,7 +358,7 @@ GEM
actionpack (>= 6.1)
activesupport (>= 6.1)
sprockets (>= 3.0.0)
thor (1.3.2)
thor (1.4.0)
thwait (0.2.0)
e2mmap
timeout (0.4.3)
Expand Down Expand Up @@ -411,6 +410,7 @@ DEPENDENCIES
logger
lograge
mutations
mutex_m
ostruct
passenger
pg
Expand Down Expand Up @@ -438,7 +438,7 @@ DEPENDENCIES
webmock

RUBY VERSION
ruby 3.4.4p34
ruby 3.4.5p51

BUNDLED WITH
2.6.9
2.7.1
9 changes: 9 additions & 0 deletions app/controllers/api/ais_controller.rb
Original file line number Diff line number Diff line change
Expand Up @@ -147,6 +147,15 @@ def make_request(system_prompt, user_prompt, stream)
missed = true
end
boundary = buffer.index("\n\n")
begin
err_msg = JSON.parse(buffer)["error"]
puts "AI #{context_key} error:" \
" (#{err_msg})" unless Rails.env.test?
current_device.tell("Please try again", ["toast"], "error")
return {"error" => {"message" => err_msg}}
rescue JSON::ParserError
nil
end
while not boundary.nil?
data_str = buffer.slice(0, boundary)
buffer = buffer.slice(boundary + 2, buffer.length)
Expand Down
13 changes: 10 additions & 3 deletions app/controllers/dashboard_controller.rb
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
class DashboardController < ApplicationController
before_action :set_global_config
skip_before_action :verify_authenticity_token, only: [:csp_reports]

Check failure

Code scanning / CodeQL

CSRF protection weakened or disabled High

Potential CSRF vulnerability due to forgery protection being disabled or weakened.

Copilot Autofix

AI 4 months ago

To fix the potential CSRF vulnerability, we should remove the line that disables CSRF protection (skip_before_action :verify_authenticity_token, only: [:csp_reports]) from the DashboardController. This will restore the default CSRF protection provided by Rails and ensure that all actions, including csp_reports, require valid CSRF tokens. If there is a valid need to allow CSRF-exempt endpoints, a more secure approach should be taken (such as limiting the action format to JSON, authenticating requests, or whitelisting trusted sources; but that is outside the scope since we only have the provided snippet). Remove line 3 from app/controllers/dashboard_controller.rb.


Suggested changeset 1
app/controllers/dashboard_controller.rb

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/app/controllers/dashboard_controller.rb b/app/controllers/dashboard_controller.rb
--- a/app/controllers/dashboard_controller.rb
+++ b/app/controllers/dashboard_controller.rb
@@ -1,6 +1,5 @@
 class DashboardController < ApplicationController
   before_action :set_global_config
-  skip_before_action :verify_authenticity_token, only: [:csp_reports]
   layout "dashboard"
 
   # === THESE CONSTANTS ARE CONFIGURABLE: ===
EOF
@@ -1,6 +1,5 @@
class DashboardController < ApplicationController
before_action :set_global_config
skip_before_action :verify_authenticity_token, only: [:csp_reports]
layout "dashboard"

# === THESE CONSTANTS ARE CONFIGURABLE: ===
Copilot is powered by AI and may make mistakes. Always verify output.
layout "dashboard"

# === THESE CONSTANTS ARE CONFIGURABLE: ===
Expand Down Expand Up @@ -102,10 +103,16 @@
payload = request.body.read || ""
begin
report = JSON.parse(payload)
rescue
report = { problem: "Crashed while parsing report" }
rescue JSON::ParserError => e
report = {
error: "CSP report parse error",
exception: e.message,
raw: payload,
}
end
render json: report

Rollbar.info("CSP Violation Report", report)
head :no_content
end

# (for self hosted users) Direct image upload endpoint.
Expand Down
15 changes: 15 additions & 0 deletions app/models/celery_script_settings_bag.rb
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,10 @@ def self.exists?(id)

ALLOWED_ASSERTION_TYPES = %w(abort recover abort_recover continue)
ALLOWED_AXIS = %w(x y z all)
ALLOWED_GROUPING = %w(xyz x,yz yz,x y,xz xz,y z,xy xy,z
x,y,z x,z,y y,x,z y,z,x z,x,y z,y,x
xy x,y y,x xz x,z z,x yz y,z z,y x y z)
ALLOWED_ROUTE = %w(high low in_order)
ALLOWED_CHANGES = %w(add remove update)
ALLOWED_CHANNEL_NAMES = %w(ticker toast email espeak)
ALLOWED_LHS_STRINGS = [*(0..69)].map { |x| "pin#{x}" }.concat(%w(x y z))
Expand Down Expand Up @@ -56,6 +60,8 @@ def self.exists?(id)
BAD_ASSERTION_TYPE = '"%s" is not a valid assertion type. ' \
"Try these instead: %s"
BAD_AXIS = '"%s" is not a valid axis. Allowed values: %s'
BAD_GROUPING = '"%s" is not a valid grouping. Allowed values: %s'
BAD_ROUTE = '"%s" is not a valid route. Allowed values: %s'
BAD_CHANNEL_NAME = '"%s" is not a valid channel_name. Allowed values: %s'
BAD_LHS = 'Can not put "%s" into a left hand side (LHS) argument. ' \
"Allowed values: %s"
Expand Down Expand Up @@ -112,6 +118,8 @@ def self.exists?(id)

CORPUS_ENUM = {
ALLOWED_AXIS: [ALLOWED_AXIS, BAD_AXIS],
ALLOWED_GROUPING: [ALLOWED_GROUPING, BAD_GROUPING],
ALLOWED_ROUTE: [ALLOWED_ROUTE, BAD_ROUTE],
ALLOWED_SPECIAL_VALUE: [ALLOWED_SPECIAL_VALUE, BAD_SPECIAL_VALUE],
ALLOWED_CHANNEL_NAMES: [ALLOWED_CHANNEL_NAMES, BAD_CHANNEL_NAME],
ALLOWED_MESSAGE_TYPES: [ALLOWED_MESSAGE_TYPES, BAD_MESSAGE_TYPE],
Expand Down Expand Up @@ -206,6 +214,8 @@ def self.v(symbol)
url: { defn: [v(:string)] },
value: { defn: [v(:string), v(:integer), v(:boolean)] },
variance: { defn: [v(:integer)] },
grouping: { defn: [e(:ALLOWED_GROUPING)] },
route: { defn: [e(:ALLOWED_ROUTE)] },
version: { defn: [v(:integer)] },
x: { defn: [v(:integer), v(:float)] },
y: { defn: [v(:integer), v(:float)] },
Expand Down Expand Up @@ -557,6 +567,10 @@ def self.v(symbol)
args: [],
tags: [:data],
},
axis_order: {
args: [:grouping, :route],
tags: [:data],
},
random: {
args: [:variance],
tags: [:data],
Expand All @@ -566,6 +580,7 @@ def self.v(symbol)
:axis_overwrite,
:axis_addition,
:speed_overwrite,
:axis_order,
:safe_z,
],
tags: [:function, :firmware_user],
Expand Down
2 changes: 1 addition & 1 deletion app/mutations/auth/create_token_from_credentials.rb
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ def validate
whoops! unless maybe_user
@user = maybe_user
end
rescue OpenSSL::PKey::RSAError => e
rescue OpenSSL::PKey::RSAError, JSON::ParserError
whoops!(BAD_KEY)
end

Expand Down
Loading