app/resources/locales/en_US/default.po

@@ -294,6 +294,9 @@ msgstr "Incorrect arguments provided to {0}"
 msgid "match.er.attr.req"
 msgstr "Required attribute {0} not found in request"
 
+msgid "match.er.attrmap.unknown"
+msgstr "Unknown Attribute Map {0}"
+
 msgid "match.er.bl.line"
 msgstr "Error at line {0}: {1}"
 
@@ -354,6 +357,9 @@ msgstr "A Matchgrid with table name {0} already exists"
 msgid "match.er.mg.notfound"
 msgstr "Matchgrid table not found, was the Matchgrid built? ({0})"
 
+msgid "match.er.mg.rename"
+msgstr "A Matchgrid cannot be renamed"
+
 msgid "match.er.mgid"
 msgstr "Could not find Matchgrid ID in request"
 

app/src/Controller/AttributeMappingsController.php

@@ -50,7 +50,7 @@ public function install() {
 
       $this->Flash->success(__('match.rs.AttributeMappings.install'));
     }
-    catch(Exception $e) {
+    catch(\Exception $e) {
       $this->Flash->error($e->getMessage());
     }
 

app/src/Model/Table/AttributeMappingsTable.php

@@ -62,10 +62,15 @@ public function initialize(array $config): void {
    * 
    * @param  int    $attributeMapId Attribute Map ID to install into
    * @param  string $mapping        Mapping to install, currently only "nicknames.en" is supported
+   * @throws \InvalidArgumentException
    * @throws \RuntimeException
    */
 
   public function install(int $attributeMapId, string $mapping) {
+    if($mapping != 'nicknames.en') {
+      throw new \InvalidArgumentException(__('match.er.attrmap.unknown', $mapping));
+    }
+
     // For now, we assume this is the CSV file from this project:
     // https://github.com/carltonnorthern/nickname-and-diminutive-names-lookup
     $infile = fopen(ROOT . DS . "vendor" . DS . "nicknames" . DS . "names.csv", "r");

app/src/Model/Table/MatchgridsTable.php

@@ -162,6 +162,12 @@ public function buildRules(RulesChecker $rules): RulesChecker {
                       'isActive',
                       ['errorField' => 'status']);
 
+    // The Matchgrid table name cannot be changed once created. For a discussion of
+    // the complexities of renaming a Matchgrid, see CO-2441.
+    $rules->addUpdate([$this, 'ruleMatchgridRenamed'],
+                      'matchgridRenamed',
+                      ['errorField' => 'table_name']);
+
     return $rules;
   }
 
@@ -277,6 +283,24 @@ public function ruleIsUnique($entity, array $options): bool|string {
 
     return true;
   }
+
+  /**
+   * Application Rule to determine if the Matchgrid is being renamed.
+   *
+   * @param   Entity  $entity   Entity to be validated
+   * @param   array   $options  Application rule options
+   *
+   * @return bool|string true if the Rule check passes, false otherwise
+   * @since  COmanage Match v1.2.2
+   */
+
+  public function ruleMatchgridRenamed($entity, array $options): bool|string {
+    if($entity->isDirty('table_name')) {
+      return __('match.er.mg.rename');
+    }
+
+    return true;
+  }
 
   /**
    * Determine if the Matchgrid table exists.

app/templates/Matchgrids/columns.inc

@@ -30,6 +30,9 @@ $indexColumns = [
     'type' => 'link',
     'cssClass' => 'row-link'
   ],
+  'description' => [
+    'type' => 'echo'
+  ],
   'status' => [
     'type' => 'enum',
     'class' => 'StatusEnum'

app/templates/email/text/potential_match.php

@@ -30,7 +30,7 @@
 <?php if(is_readable($localTemplate)): ?>
 <?php include($localTemplate); ?>
 <?php else: ?>
-?>
+
 A new potential match is available for your review. You may access the
 pending request at this URL:
 

app/templates/layout/default.php

@@ -31,6 +31,7 @@
 header("Expires: Thursday, 10-Jan-69 00:00:00 GMT");
 header("Cache-Control: no-store, no-cache, max-age=0, must-revalidate");
 header("Pragma: no-cache");
+header("Content-Security-Policy: frame-ancestors 'self'");
 
 // Add X-UA-Compatible header for IE
 if(isset($_SERVER['HTTP_USER_AGENT']) && (strpos($_SERVER['HTTP_USER_AGENT'], 'MSIE') !== false)) {

app/templates/layout/error.php

@@ -12,6 +12,8 @@
  * @since         0.10.0
  * @license       https://opensource.org/licenses/mit-license.php MIT License
  */
+
+  header("Content-Security-Policy: frame-ancestors 'self'");
 ?>
 <!DOCTYPE html>
 <html>

app/webroot/.htaccess

@@ -3,3 +3,7 @@
     RewriteCond %{REQUEST_FILENAME} !-f
     RewriteRule ^ index.php [L]
 </IfModule>
+
+<IfModule mod_autoindex.c>
+  Options -Indexes
+</IfModule>

container/match/base/Dockerfile

@@ -16,7 +16,7 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-ARG PHP_IMAGE_VERSION=8.1.23
+ARG PHP_IMAGE_VERSION=8.1.27
 FROM php:${PHP_IMAGE_VERSION}-apache-bullseye
 
 # Official PHP image with Apache HTTPD includes

container/match/base/comanage_utils.sh

@@ -87,6 +87,7 @@ function comanage_utils::consume_injected_environment() {
         COMANAGE_MATCH_SECURITY_SALT
         COMANAGE_MATCH_PHP_SESSION_REDIS_URL
         COMANAGE_MATCH_SKIP_SETUP
+        COMANAGE_MATCH_SKIP_UPGRADE
         COMANAGE_MATCH_SLASH_ROOT_DIRECTORY
         COMANAGE_MATCH_VIRTUAL_HOST_FQDN
         COMANAGE_MATCH_VIRTUAL_HOST_REDIRECT_HTTP_NO
@@ -734,6 +735,56 @@ function comanage_utils::match_setup() {
     fi
 }
 
+##########################################
+# Run COmanage Match upgradeVersion shell command
+# Globals:
+#   COMANAGE_MATCH_DATABASE_SCHEMA_FORCE
+#   COMANAGE_MATCH_DATABASE_SKIP_UPGRADE
+#   COMANAGE_MATCH_DIR
+#   OUTPUT
+# Arguments:
+#   None
+# Returns:
+#   None
+##########################################
+function comanage_utils::match_upgrade() {
+
+    if [[ -n "${COMANAGE_MATCH_SKIP_UPGRADE}" ]]; then
+        echo "Skipping upgrade step" > "$OUTPUT" 2>&1
+        return 0
+    fi
+
+    # We always run upgradeVersion since it will not make any changes
+    # if the current and target versions are the same or if
+    # an upgrade from the current to the target version is not allowed.
+
+    # First clear the caches.
+    comanage_utils::match_clear_cache
+
+    pushd "$COMANAGE_MATCH_DIR/app" > "$OUTPUT" 2>&1
+    echo "Running ./bin/cake upgradeVersion..." > "$OUTPUT"
+    ./bin/cake upgradeVersion > "$OUTPUT" 2>&1
+    echo "Done running ./bin/cake upgradeVersion" > "$OUTPUT"
+    echo "You may ignore errors reported above if the Current and Target versions are the same" > "$OUTPUT"
+    popd > "$OUTPUT" 2>&1
+
+    # Force a datbase update if requested. This is helpful when deploying
+    # a new version of the code that does not result in a change in the
+    # version number and so upgradeVersion does not fire. An example
+    # of this scenario is when new code is introduced in the develop
+    # branch but before a release happens.
+    if [ -n "$COMANAGE_MATCH_DATABASE_SCHEMA_FORCE" ]; then
+        echo "Forcing a database schema update..." > "$OUTPUT"
+        pushd "$COMANAGE_MATCH_DIR/app" > "$OUTPUT" 2>&1
+        ./bin/cake database > "$OUTPUT" 2>&1
+        echo "Done forcing database schema update" > "$OUTPUT"
+        popd > "$OUTPUT" 2>&1
+    fi
+
+    # Clear the caches again.
+    comanage_utils::match_clear_cache
+}
+
 ##########################################
 # Set tmp directory file ownership
 # Globals:

container/shibboleth-sp-base/Dockerfile

@@ -22,7 +22,7 @@ ARG LOG4SHIB_VERSION
 ENV LOG4SHIB_VERSION=${LOG4SHIB_VERSION:-2.0.1}
 
 ARG XERCESC_VERSION
-ENV XERCESC_VERSION=${XERCESC_VERSION:-3.2.4}
+ENV XERCESC_VERSION=${XERCESC_VERSION:-3.2.5}
 
 ARG XMLSECC_VERSION
 ENV XMLSECC_VERSION=${XMLSECC_VERSION:-2.0.4}