From b3a4d50d2b2b7177a004c76eca5505b8829ee142 Mon Sep 17 00:00:00 2001 From: Ahmad Afandi Date: Thu, 8 Oct 2026 15:42:12 +0700 Subject: [PATCH 1/4] hanya bisa diedit oleh dirinya sendiri --- resources/views/user/form.blade.php | 2 +- tests/Feature/UserControllerTest.php | 43 ++++++++++++++++++++++++---- 2 files changed, 39 insertions(+), 6 deletions(-) diff --git a/resources/views/user/form.blade.php b/resources/views/user/form.blade.php index 1d48620197..b2efe67910 100644 --- a/resources/views/user/form.blade.php +++ b/resources/views/user/form.blade.php @@ -28,7 +28,7 @@
- @if (empty($user)) + @if (empty($user) || auth()->id() == $user->id) {!! html()->text('email')->class('form-control')->placeholder('Email')->value(old('email', isset($user) ? $user->email : '')) !!} @else {!! html()->text('email', old('email', $user->email))->class('form-control')->placeholder('Email')->isReadonly() !!} diff --git a/tests/Feature/UserControllerTest.php b/tests/Feature/UserControllerTest.php index 9b0f2c36e9..38669f86fa 100644 --- a/tests/Feature/UserControllerTest.php +++ b/tests/Feature/UserControllerTest.php @@ -31,15 +31,14 @@ namespace Tests\Feature; -use App\Models\User; use App\Models\Pengurus; -use Spatie\Permission\Models\Role; +use App\Models\User; use Database\Seeders\RefAgamaTableSeeder; use Database\Seeders\RefPendidikanTableSeeder; use Illuminate\Foundation\Testing\DatabaseTransactions; use Illuminate\Foundation\Testing\WithFaker; use Illuminate\Support\Facades\Storage; -use Illuminate\Support\Facades\Hash; +use Spatie\Permission\Models\Role; use Tests\CrudTestCase; class UserControllerTest extends CrudTestCase @@ -198,6 +197,40 @@ public function test_edit_displays_form_for_user_editing_own_profile() $response->assertViewHas('user', $user); } + /** + * Test edit form keeps email readonly when editing another user. + * + * @return void + */ + public function test_edit_form_email_is_readonly_when_editing_another_user() + { + $superAdmin = User::whereHas('roles', function ($query) { + $query->where('name', 'super-admin'); + })->first(); + + $targetUser = User::where('id', '!=', $superAdmin->id)->first(); + + $response = $this->actingAs($superAdmin)->get(route('setting.user.edit', $targetUser->id)); + + $response->assertStatus(200); + $this->assertMatchesRegularExpression('/]*name="email"[^>]*readonly/i', $response->getContent()); + } + + /** + * Test edit form allows email change when editing own profile. + * + * @return void + */ + public function test_edit_form_email_is_editable_when_editing_own_profile() + { + $user = User::first(); + + $response = $this->actingAs($user)->get(route('setting.user.edit', $user->id)); + + $response->assertStatus(200); + $this->assertDoesNotMatchRegularExpression('/]*name="email"[^>]*readonly/i', $response->getContent()); + } + /** * Test update method updates user successfully for super admin. * @@ -318,7 +351,7 @@ public function test_active_activates_user_successfully() * * @return void */ - public function test_getDataUser_returns_json_response() + public function test_get_data_user_returns_json_response() { $user = User::first(); @@ -384,4 +417,4 @@ private function createTestUsers() ]); $user->assignRole('user'); } -} \ No newline at end of file +} From 320a8f8ad0551ebd079c7546bcb147cce1fd79f4 Mon Sep 17 00:00:00 2001 From: Ahmad Afandi Date: Thu, 8 Oct 2026 16:56:38 +0700 Subject: [PATCH 2/4] perbaikan upload foto ketika buat user --- lang/id/validation.php | 2 +- resources/views/user/create.blade.php | 2 +- tests/Feature/Settings/UserManagementCrudTest.php | 12 ++++++++++++ tests/Unit/ValidFileContentTest.php | 6 ++++++ 4 files changed, 20 insertions(+), 2 deletions(-) diff --git a/lang/id/validation.php b/lang/id/validation.php index 1923e40193..4842f1f8af 100644 --- a/lang/id/validation.php +++ b/lang/id/validation.php @@ -98,7 +98,7 @@ 'timezone' => 'Isian :attribute harus berupa zona waktu yang valid.', 'unique' => 'Isian :attribute sudah ada sebelumnya.', 'url' => 'Format isian :attribute tidak valid.', - 'valid_file' => 'Format :Jenis berkas yang anda unggah berbahaya.', + 'valid_file' => 'Jenis berkas yang anda unggah berbahaya.', 'custom' => [ 'attribute-name' => [ 'rule-name' => 'custom-message', diff --git a/resources/views/user/create.blade.php b/resources/views/user/create.blade.php index efab87d89a..b46d905d7d 100644 --- a/resources/views/user/create.blade.php +++ b/resources/views/user/create.blade.php @@ -26,7 +26,7 @@
@endif - {!! html()->form()->route('setting.user.store')->method('post')->attribute('files', true)->id('form-user')->class('form-horizontal form-label-left')->open() !!} + {!! html()->form()->route('setting.user.store')->method('post')->acceptsFiles()->id('form-user')->class('form-horizontal form-label-left')->open() !!} @include('flash::message') @include('user.form') {!! html()->form()->close() !!} diff --git a/tests/Feature/Settings/UserManagementCrudTest.php b/tests/Feature/Settings/UserManagementCrudTest.php index 413cb89fed..c30561d270 100644 --- a/tests/Feature/Settings/UserManagementCrudTest.php +++ b/tests/Feature/Settings/UserManagementCrudTest.php @@ -74,6 +74,18 @@ $response->assertViewHas('page_description', 'Tambah Data'); }); + test('create form uses multipart encoding so photo upload reaches the server', function () { + $superAdmin = User::whereHas('roles', fn($q) => $q->where('name', 'super-admin'))->first(); + + $response = $this->actingAs($superAdmin)->get(route('setting.user.create')); + + $response->assertStatus(200); + + preg_match('/]*id="form-user"[^>]*>/', $response->getContent(), $matches); + + expect($matches[0] ?? '')->toContain('enctype="multipart/form-data"'); + }); + test('store creates new user successfully', function () { Storage::fake('public'); diff --git a/tests/Unit/ValidFileContentTest.php b/tests/Unit/ValidFileContentTest.php index da644a0416..210f4831ba 100644 --- a/tests/Unit/ValidFileContentTest.php +++ b/tests/Unit/ValidFileContentTest.php @@ -133,4 +133,10 @@ function passRule(mixed $file): bool expect($validator->errors()->first('file_dokumen')) ->toBe(trans('validation.valid_file', ['attribute' => 'file dokumen'])); }); + + test('pesan valid_file tidak menyisakan placeholder', function () { + $pesan = trans('validation.valid_file', ['attribute' => 'file dokumen']); + + expect($pesan)->not->toMatch('/:\w+/'); + }); }); From 67d56c4614fb94e01a18c315597dbe690805389f Mon Sep 17 00:00:00 2001 From: Ahmad Afandi Date: Fri, 9 Oct 2026 08:35:49 +0700 Subject: [PATCH 3/4] perbaikan test yang gagal --- tests/Browser/Pages/UserPage.php | 6 ++++-- .../default/resources/views/pages/potensi/index.blade.php | 2 +- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/tests/Browser/Pages/UserPage.php b/tests/Browser/Pages/UserPage.php index 9c70a6c0f3..218ec9e485 100644 --- a/tests/Browser/Pages/UserPage.php +++ b/tests/Browser/Pages/UserPage.php @@ -24,8 +24,10 @@ public function createUser($browser, array $userDetails): void ->type('email', $userDetails['email']) ->type('password', $userDetails['password']) ->type('address', $userDetails['address']) - ->select('role', $userDetails['role']) - ->press('Simpan'); + ->select('role', $userDetails['role']); + + $browser->script("document.getElementById('form-user').setAttribute('enctype', 'application/x-www-form-urlencoded')"); + $browser->press('Simpan'); } /** diff --git a/themes/opendk/default/resources/views/pages/potensi/index.blade.php b/themes/opendk/default/resources/views/pages/potensi/index.blade.php index 7b5c85eb52..deecba54dc 100644 --- a/themes/opendk/default/resources/views/pages/potensi/index.blade.php +++ b/themes/opendk/default/resources/views/pages/potensi/index.blade.php @@ -71,7 +71,7 @@ function loadPotensi(page = 1) { // Make API call to get potensi $.ajax({ - url: '{!! $urlApi !!}/potensi?filter[tipe.slug]={!! $slug !!}&include=tipe&page[number]=' + page, + url: '{!! $urlApi !!}/potensi?filter[tipe.slug]={!! $slug ?? '' !!}&include=tipe&page[number]=' + page, method: 'GET', success: function(response) { var items = response.data || response; From d37f6140a095621651dae6fc428512470231e4f5 Mon Sep 17 00:00:00 2001 From: Abah Roland <59082428+vickyrolanda@users.noreply.github.com> Date: Thu, 15 Oct 2026 04:22:25 +0700 Subject: [PATCH 4/4] [ci skip] memutahirkan catatan rilis --- catatan_rilis.md | 22 +--------------------- 1 file changed, 1 insertion(+), 21 deletions(-) diff --git a/catatan_rilis.md b/catatan_rilis.md index 865544e2a0..d9990a485d 100644 --- a/catatan_rilis.md +++ b/catatan_rilis.md @@ -5,29 +5,9 @@ Terimakasih [isi disini] yang telah berkontribusi langsung mengembangkan aplikas #### FITUR -1. [#1725](https://github.com/OpenSID/OpenDK/issues/1725) Penambahan fungsi pratinjau file pdf untuk kebutuhan OpenDK tidak di dukung. #### BUG -1. [#1718](https://github.com/OpenSID/OpenDK/issues/1718) Bug pada Modul Potensi – OpenDK v2608.0.2. -2. [#1724](https://github.com/OpenSID/OpenDK/issues/1724) eta Letak Geografis kosong (Bounds are not valid) karena $data_umum tidak dikirim ke view gabungan. -3. [#1721](https://github.com/OpenSID/OpenDK/issues/1721) Halaman Unduhan Dokumen hanya menampilkan data sesuai default pagination API (10 data). -4. [#1731](https://github.com/OpenSID/OpenDK/issues/1731) Perbaikan menambah anggota penduduk untuk data suplemen tidak menampilkan list penduduk & keluarga. -5. [#1732](https://github.com/OpenSID/OpenDK/issues/1732) Berkas download dokumen laporan-penduduk pada data tidak sikron dari OpenSID. -6. [#1727](https://github.com/OpenSID/OpenDK/issues/1727) Perbaikan Tampilan Thumbnail Galeri dan Pratinjau Gambar Dinamis. -7. [#1733](https://github.com/OpenSID/OpenDK/issues/1733) perbaikan filter kesehatan. -8. [#1729](https://github.com/OpenSID/OpenDK/issues/1729) perbaikan tombol sarana ui. -9. [#1730](https://github.com/OpenSID/OpenDK/issues/1730) data yang tampil pada datatable overlaping tidak di handle dengan scroll. -10. [#1735](https://github.com/OpenSID/OpenDK/issues/1735) Periksa bagian tambah ketua lembaga ketika menggunakan API satu data. -11. [#1736](http://github.com/OpenSID/OpenDK/issues/1736) Fix Penyesuaian Validasi NIK pada Pengiriman Keluhan untuk Database Gabungan (API Satu Data). -12. [#1737](https://github.com/OpenSID/OpenDK/issues/1737) fungsi kirim pesan error 500. -13. [#1761](https://github.com/OpenSID/OpenDK/issues/1761)Perbaikan validasi valid_file menolak PDF sah karena string generik "function". -14. [#1764](https://github.com/OpenSID/OpenDK/issues/1764) Gagal Menampilkan data foto/video dari link pada web dan admin. -15. [#1767](https://github.com/OpenSID/OpenDK/issues/1767)Perbaikan menu potensi pada halaman publik tidak berfungsi. +1. [#1771](https://github.com/OpenSID/OpenDK/issues/1771) Administrator utama bisa mengubah email hanya untuk akunnya sendiri. #### TEKNIS - -1. [#1713](https://github.com/OpenSID/OpenDK/issues/1713) File di storage/app/public 404 karena direktori upload dibuat permission 0700 (Flysystem directory visibility). -2. [#58](https://github.com/OpenSID/wiki-keamanan/issues/58) Insecure deserialization via Crypt::decrypt() (unserialize=true) on LogViewer user params. -3. [#57](https://github.com/OpenSID/wiki-keamanan/issues/57) CRITICAL: RCE via Theme Hook include_once — backtick execution operator bypasses ThemeHooksValidator (theme.php). -4. [#1759](https://github.com/OpenSID/OpenDK/issues/1759) Pastikan perubahan Known security vulnerabilities detected masuk rilis. \ No newline at end of file