Merge pull request #7241 from hotosm/staging

v5.5.3 to production

Author: ramyaragupathy

.github/labeler.yml

@@ -1,20 +1,34 @@
 "scope: frontend":
-  - frontend/**/*
+- changed-files:
+  - any-glob-to-any-file:
+    - frontend/**/*
+
 "scope: backend":
-  - backend/**/*
-  - tests/**/*
-  - migrations/**/*
-  - ./manage.py
-  - ./pyproject.toml
+- changed-files:
+  - any-glob-to-any-file:
+    - backend/**/*
+    - tests/**/*
+    - migrations/**/*
+    - manage.py
+    - pyproject.toml
+
 "scope: infrastructure":
-  - .circleci/*
-  - .github/**/*
-  - scripts/aws/**/*
-  - scripts/docker/**/*
-  - scripts/install/**/*
-  - docker-*.yml
+- changed-files:
+  - any-glob-to-any-file:
+    - .circleci/*
+    - .github/**/*
+    - scripts/aws/**/*
+    - scripts/docker/**/*
+    - scripts/install/**/*
+    - docker-*.yml
+
 "dependencies":
-  - frontend/yarn.lock
-  - ./pyproject.toml
+- changed-files:
+  - any-glob-to-any-file:
+    - frontend/yarn.lock
+    - pyproject.toml
+
 "scope: translations":
-  - frontend/src/locales/*
+- changed-files:
+  - any-glob-to-any-file:
+    - frontend/src/locales/*

.github/workflows/backend-build-deploy.yml

@@ -48,10 +48,10 @@ jobs:
       fail-fast: false
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v6
         with:
           aws-region: ${{ env.AWS_REGION }}
           role-to-assume: ${{ env.OIDC_ROLE_ARN }}

.github/workflows/frontend-build-deploy.yml

@@ -21,15 +21,15 @@ jobs:
 
     steps:
       - name: Clone repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Use Node.js 22.11.0
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: 22.11.0
 
       - name: Cache node_modules
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: frontend/node_modules
           key: tm-fe-${{ runner.os }}-build-${{ hashFiles('frontend/package.json') }}
@@ -62,7 +62,7 @@ jobs:
           yarn build
 
       - name: Upload Builds Artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: tm-fe-${{ github.sha }}
           path: ./frontend/build
@@ -84,10 +84,10 @@ jobs:
 
     steps:
       - name: Clone repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Download Build Artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           name: tm-fe-${{ github.sha }}
           path: ./build

.github/workflows/pr_label.yml

@@ -15,6 +15,6 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/labeler@v3
+    - uses: actions/labeler@v6
       with:
         repo-token: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/pr_test_backend.yml

@@ -16,10 +16,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Clone repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up Python 3.10
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v6
         with:
           python-version: "3.10"
 

.github/workflows/pr_test_frontend.yml

@@ -21,15 +21,15 @@ jobs:
 
     steps:
       - name: Clone repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Use Node.js 22.11.0
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: 22.11.0
 
       - name: Cache node_modules
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: frontend/node_modules
           key: tm-fe-${{ runner.os }}-build-${{ hashFiles('frontend/package.json') }}
@@ -66,7 +66,7 @@ jobs:
           yarn build
 
       - name: Upload Builds Artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: tm-fe-${{ github.sha }}
           path: ./frontend/build

backend/api/users/statistics.py

@@ -176,7 +176,7 @@ async def get_ohsome_stats(
     db: Database = Depends(get_db),
     userId: int = Query(..., description="OSM user ID"),
     topics: str = Query(
-        ..., description="Comma-separated list of OSM topics, e.g. building,highway"
+        ..., description="Comma-separated list of OSM topics, e.g. building,road"
     ),
     startdate: Optional[str] = Query(
         None, description="YYYY-MM-DD, start of time range"

backend/models/postgis/project.py

@@ -926,10 +926,15 @@ async def delete(self, db: Database):
             "project_partnerships",
         ]
 
+        # Whitelist of allowed table names to prevent SQL injection via
+        # dynamic table name interpolation, since table names cannot be parameterized.
+        allowed_tables = set(related_tables)
+
         # Start a transaction to ensure atomic deletion
         async with db.transaction():
-            # Loop through each table and execute the delete query
             for table in related_tables:
+                if table not in allowed_tables:
+                    raise ValueError(f"Invalid table name: {table}")
                 await db.execute(
                     f"DELETE FROM {table} WHERE project_id = :project_id",
                     {"project_id": self.id},

backend/models/postgis/task.py

@@ -383,15 +383,22 @@ async def update_task_locked_with_duration(
         try:
             # Fetch the last locked task history entry with raw SQL
             query = """
-                SELECT id, action_date
-                FROM task_history
-                WHERE task_id = :task_id
-                AND project_id = :project_id
-                AND action = :action
-                AND action_text IS NULL
-                AND user_id = :user_id
-                ORDER BY action_date DESC
-                LIMIT 1
+                WITH locked_rows AS (
+                    SELECT
+                        id,
+                        action_date,
+                        COUNT(*) OVER() AS total_rows
+                    FROM task_history
+                    WHERE task_id = :task_id
+                    AND project_id = :project_id
+                    AND action = :action
+                    AND action_text IS NULL
+                    AND user_id = :user_id
+                    ORDER BY action_date DESC, id DESC
+                    FETCH FIRST 1 ROW ONLY
+                )
+                SELECT id, action_date, total_rows
+                FROM locked_rows
             """
             values = {
                 "task_id": task_id,
@@ -410,6 +417,9 @@ async def update_task_locked_with_duration(
                 # No record found, possibly a race condition or auto-unlock scenario.
                 return
 
+            if last_locked["total_rows"] > 1:
+                raise MultipleResultsFound()
+
             # Calculate the duration the task was locked for
             duration_task_locked = (
                 datetime.datetime.utcnow() - last_locked["action_date"]
@@ -1183,6 +1193,14 @@ async def unlock_task(
     ):
         """Unlock the task and change its state."""
         # Add task comment history if provided
+        if not undo:
+            last_history = await TaskHistory.get_last_action(project_id, task_id, db)
+            # To unlock a task the last action must have been either lock or extension
+            last_action = TaskAction[last_history.action]
+            await TaskHistory.update_task_locked_with_duration(
+                task_id, project_id, last_action, user_id, db
+            )
+
         if comment:
             await Task.set_task_history(
                 task_id,
@@ -1283,12 +1301,6 @@ async def unlock_task(
                             "project_id": project_id,
                         },
                     )
-
-            # Update task locked duration in the history when `undo` is False
-            # Using a slightly evil side effect of Actions and Statuses having the same name here :)
-            await TaskHistory.update_task_locked_with_duration(
-                task_id, project_id, TaskStatus(current_status), user_id, db
-            )
         # Final query for updating task status
         final_update_query = """
             UPDATE tasks
@@ -1333,10 +1345,12 @@ async def reset_lock(
                 db=db,
             )
         # Update task lock history with duration
+        last_history = await TaskHistory.get_last_action(project_id, task_id, db)
+        last_action = TaskAction[last_history.action]
         await TaskHistory.update_task_locked_with_duration(
             task_id=task_id,
             project_id=project_id,
-            lock_action=TaskStatus(task_status),
+            lock_action=last_action,
             user_id=user_id,
             db=db,
         )

backend/services/mapping_service.py

@@ -544,7 +544,6 @@ async def lock_time_can_be_extended(
             raise NotFound(
                 sub_code="TASK_NOT_FOUND", project_id=project_id, task_id=task_id
             )
-
         if TaskStatus(task.task_status) not in [
             TaskStatus.LOCKED_FOR_MAPPING,
             TaskStatus.LOCKED_FOR_VALIDATION,
@@ -574,14 +573,18 @@ async def extend_task_lock_time(extend_dto: ExtendLockTimeDTO, db: Database):
             task = await Task.get(task_id, extend_dto.project_id, db)
             action = (
                 TaskAction.EXTENDED_FOR_MAPPING
-                if task["task_status"] == TaskStatus.LOCKED_FOR_MAPPING
+                if TaskStatus(task.task_status) == TaskStatus.LOCKED_FOR_MAPPING
                 else TaskAction.EXTENDED_FOR_VALIDATION
             )
 
+            last_history = await TaskHistory.get_last_action(
+                extend_dto.project_id, task_id, db
+            )
+            last_action = TaskAction[last_history.action]
             await TaskHistory.update_task_locked_with_duration(
                 task_id,
                 extend_dto.project_id,
-                TaskStatus(task["task_status"]),
+                last_action,
                 extend_dto.user_id,
                 db,
             )