geant / core Goto Github PK

I edited the abstract for my TNC2013 presentation. I wanted a new line, so I 
used <br>. Then I realized that I could write JS, CSS tags and code in the 
abstract text area.

What steps will reproduce the problem?
1. Go to TNC2013 presentation page (eg. 
https://tnc2013.terena.org/core/presentation/36)
2. Edit 
3. Include HTML,Javascript,CSS code in Abstract eg.
<script type="text/javascript">
$(function() {
    alert('this is js');
});
</script>
<link href="http://twitter.github.com/bootstrap/assets/css/bootstrap.css" 
rel="stylesheet">

What is the expected output?
Certain HTML tags should be stripped. JS should not be executed. CSS should not 
be applied.

What do you see instead?
JS is executed. Bootstrap CSS is applied in current page


What version of the product are you using?
TNC2013 webpage

On what operating system?
Ubuntu 12.04 32bit/Firefox 18.0.2

Please provide any additional information below.
Screenshot attached. There might be a small possibility that submit could be 
done via jquery $.post in abstract but haven't tried yet.


BR.

Leonidas Poulopoulos

Speakers have trouble finding the right page where they can edit their 
presentation.

One way is to click 'Edit account', then there are links all the way down at 
the bottom. On laptops you have to scroll down to see it.
The links are in the same color and font as the rest of the page. Worse, they 
are not underlined, so they only way to find out that they are links is by 
hovering over them.

When logged in, the presentation page shows an 'Edit' link next to the 
presentation title, which is also visually not very distinct (i.e. same font/ 
grey colour).

Internet Explorer users are presented with an error if they want to open 
presentation, slides, etc:

<filenumber> couldn't be downloaded.


This is caused by Internet Explorer having the option "Do not save encrypted 
files to disk" set. This option is located under Tools -> Internet Options -> 
Advanced, then somewhere at the end under the Security settings.

This is not a bug, but merely a feature of Internet Explorer.

In some scenarios (such as restricitive group policies) it might not be 
possible for an end user to change this configuration item.

Implement a web page that displays all the uploaded presentations in an 
FTP-like directory tree.
This way tools such as wget can be used to create an offline archive of 
presentations.
This is useful for presentation computers at the conference.

Such a page should use basic authentication so that simple tools such as wget 
can easily use it without problems.

For schedules with lots of locations where not every location has a session on 
a certain day, the schedule will become very long with lots of empty rows. 
This could be improved by automatically hiding rows that have no sessions 
associated on that day.

I've installed: postgresql 9.1 on ubuntu server 12.04 LTS and followed the 
following tutorial to create the database and install CORE

https://confluence.terena.org/display/core/Installation+and+requirements

At the last step in the installer of CORE called "save and install" it gives 
the error.

When I submit a second time it creates another error. When submitting more this 
error does not go way

error: ERROR: schema "feedback" already exists

I've made sure the database was as fresh as in the tutorial. The postgresql is 
a clean install aswell. It is not used for any other application.

For questions I am available at [email protected] and @live.nl

This is a spam patch, removed.

What steps will reproduce the problem?
1. Submit a file with non-standard characters
2. Assign the paper to a reviewer
3. As a reviewer, download the ZIP archive of all the papers


What is the expected output? 
ZIP file that contains all the files, and all the files can be extracted.

What do you see instead?
ZIP file that contains all the files, but some files cannot be extracted.
Windows for instance b0rks on specific files:


Extracting to "C:\Users\blah\AppData\Local\Temp\"
Use Path: no   Overlay Files: yes
caution: filename not matched:  1050_TNC-MonIP+è-v10.pdf
error:  no files were found - nothing to do


After renaming the submission file name to something that does not have 
international characters, and regenerating the ZIP file, everything works as 
expected (i.e. all files can be extracted).

The uploads directory will accumulate files forever, even if the file is not 
used any more.
One way to fix this is a vacuum script that would be run from CRON.

This would remove any files that are not in the files table, and report any 
files that exist but are not in the table.

When session date approaches, send automatic reminders to speakers that have 
not uploaded their presentation slides yet. 

It would be great if there was one single persistent ID for each submission. 
As a reviewer the various IDs (review ID, submission ID, file ID) can become 
very confusing when working with other reviewers to create a program because 
there are file IDs, review IDs .

The overview page (/core/submit/list) then could list this submission ID 
(instead of the current file ID that may change), all links to the reviews 
(e.g. /core/review/list/#submissionID#) or the file (e.g. 
/core/getabstract/#submissionID#) could then work with this single ID, which 
would make it a lot easier for the reviewers to talk about the submissions just 
by mentioning the IDs.

It should be possible to disable logins once the conference has ended for a 
while.

Otherwise presentations and users profiles can be edited indefinitely, which is 
not good.