Updated translations

Signed-off-by: snipe <snipe@snipe.net>
Bumped version
2022-04-11 15:40:58 +01:00 · 2022-04-11 15:37:38 +01:00 · 2022-04-11 15:08:39 +01:00 · 2022-04-11 15:03:08 +01:00 · 2022-04-11 14:29:59 +01:00 · 2022-04-07 19:41:01 +01:00
1714 changed files with 34078 additions and 11518 deletions
@@ -2522,6 +2522,42 @@
      "contributions": [
        "code"
      ]
+    },
+    {
+      "login": "UniversalSuperBox",
+      "name": "Dalton Durst",
+      "avatar_url": "https://avatars.githubusercontent.com/u/21966173?v=4",
+      "profile": "https://daltondur.st",
+      "contributions": [
+        "code"
+      ]
+    },
+    {
+      "login": "TenOfTens",
+      "name": "TenOfTens",
+      "avatar_url": "https://avatars.githubusercontent.com/u/48162670?v=4",
+      "profile": "https://github.com/TenOfTens",
+      "contributions": [
+        "code"
+      ]
+    },
+    {
+      "login": "savornicesei",
+      "name": "Simona Avornicesei",
+      "avatar_url": "https://avatars.githubusercontent.com/u/917232?v=4",
+      "profile": "http://www.avornicesei.com",
+      "contributions": [
+        "test"
+      ]
+    },
+    {
+      "login": "QveenSi",
+      "name": "Yevhenii Huzii",
+      "avatar_url": "https://avatars.githubusercontent.com/u/19945501?v=4",
+      "profile": "https://github.com/QveenSi",
+      "contributions": [
+        "code"
+      ]
    }
  ]
 }
@@ -145,10 +145,12 @@ APP_LOG_MAX_FILES=10
 APP_LOCKED=false
 APP_CIPHER=AES-256-CBC
 APP_FORCE_TLS=false
+APP_ALLOW_INSECURE_HOSTS=false
 GOOGLE_MAPS_API=
 LDAP_MEM_LIM=500M
 LDAP_TIME_LIM=600
 IMPORT_TIME_LIMIT=600
 IMPORT_MEMORY_LIMIT=500M
 REPORT_TIME_LIMIT=12000
-
+REQUIRE_SAML=false
+API_THROTTLE_PER_MINUTE=120
@@ -77,6 +77,8 @@ COPY . /var/www/html

 RUN a2enmod rewrite

+COPY docker/column-statistics.cnf /etc/mysql/conf.d/column-statistics.cnf
+
 ############ INITIAL APPLICATION SETUP #####################

 WORKDIR /var/www/html
@@ -32,6 +32,8 @@ RUN  apk add --no-cache \
        mysql-client \
        tini

+COPY docker/column-statistics.cnf /etc/mysql/conf.d/column-statistics.cnf
+
 # Where apache's PID lives
 RUN mkdir -p /run/apache2 && chown apache:apache /run/apache2

@@ -98,5 +98,6 @@ VOLUME [ "/var/lib/snipeit" ]

 COPY --chown=www-data:www-data docker/docker-secrets.env /var/www/html/.env
 COPY --chmod=655 docker/docker-entrypoint.sh /usr/local/bin/docker-snipeit-entrypoint
+COPY docker/column-statistics.cnf /etc/mysql/conf.d/column-statistics.cnf
 ENTRYPOINT [ "/usr/local/bin/docker-snipeit-entrypoint" ]
 CMD [ "/usr/local/bin/docker-php-entrypoint", "php-fpm" ]
@@ -1,5 +1,5 @@
 ![Build Status](https://app.chipperci.com/projects/0e5f8979-31eb-4ee6-9abf-050b76ab0383/status/master) [![Crowdin](https://d322cqt584bo4o.cloudfront.net/snipe-it/localized.svg)](https://crowdin.com/project/snipe-it) [![Docker Pulls](https://img.shields.io/docker/pulls/snipe/snipe-it.svg)](https://hub.docker.com/r/snipe/snipe-it/) [![Twitter Follow](https://img.shields.io/twitter/follow/snipeitapp.svg?style=social)](https://twitter.com/snipeitapp)  [![Codacy Badge](https://api.codacy.com/project/badge/Grade/553ce52037fc43ea99149785afcfe641)](https://www.codacy.com/app/snipe/snipe-it?utm_source=github.com&amp;utm_medium=referral&amp;utm_content=snipe/snipe-it&amp;utm_campaign=Badge_Grade)
-[![All Contributors](https://img.shields.io/badge/all_contributors-277-orange.svg?style=flat-square)](#contributors) [![Discord](https://badgen.net/badge/icon/discord?icon=discord&label)](https://discord.gg/yZFtShAcKk) [![huntr](https://cdn.huntr.dev/huntr_security_badge_mono.svg)](https://huntr.dev)
+[![All Contributors](https://img.shields.io/badge/all_contributors-281-orange.svg?style=flat-square)](#contributors) [![Discord](https://badgen.net/badge/icon/discord?icon=discord&label)](https://discord.gg/yZFtShAcKk) [![huntr](https://cdn.huntr.dev/huntr_security_badge_mono.svg)](https://huntr.dev)

 ## Snipe-IT - Open Source Asset Management System

@@ -130,7 +130,8 @@ Thanks goes to all of these wonderful people ([emoji key](https://github.com/ken
 | [<img src="https://avatars.githubusercontent.com/u/11823649?v=4" width="110px;"/><br /><sub>Renee Margaret McConahy</sub>](https://github.com/nepella)<br />[💻](https://github.com/snipe/snipe-it/commits?author=nepella "Code") | [<img src="https://avatars.githubusercontent.com/u/5553884?v=4" width="110px;"/><br /><sub>JohnnyPicnic</sub>](https://github.com/JohnnyPicnic)<br />[💻](https://github.com/snipe/snipe-it/commits?author=JohnnyPicnic "Code") | [<img src="https://avatars.githubusercontent.com/u/8799594?v=4" width="110px;"/><br /><sub>markbrule</sub>](https://github.com/markbrule)<br />[💻](https://github.com/snipe/snipe-it/commits?author=markbrule "Code") | [<img src="https://avatars.githubusercontent.com/u/1962801?v=4" width="110px;"/><br /><sub>Mike Campbell</sub>](https://github.com/mikecmpbll)<br />[💻](https://github.com/snipe/snipe-it/commits?author=mikecmpbll "Code") | [<img src="https://avatars.githubusercontent.com/u/11973217?v=4" width="110px;"/><br /><sub>tbrconnect</sub>](https://github.com/tbrconnect)<br />[💻](https://github.com/snipe/snipe-it/commits?author=tbrconnect "Code") | [<img src="https://avatars.githubusercontent.com/u/12447225?v=4" width="110px;"/><br /><sub>kcoyo</sub>](https://github.com/kcoyo)<br />[💻](https://github.com/snipe/snipe-it/commits?author=kcoyo "Code") | [<img src="https://avatars.githubusercontent.com/u/494017?v=4" width="110px;"/><br /><sub>Travis Miller</sub>](https://travismiller.com/)<br />[💻](https://github.com/snipe/snipe-it/commits?author=travismiller "Code") |
 | [<img src="https://avatars.githubusercontent.com/u/8735148?v=4" width="110px;"/><br /><sub>Petri Asikainen</sub>](https://github.com/PetriAsi)<br />[💻](https://github.com/snipe/snipe-it/commits?author=PetriAsi "Code") | [<img src="https://avatars.githubusercontent.com/u/11424540?v=4" width="110px;"/><br /><sub>derdeagle</sub>](https://github.com/derdeagle)<br />[💻](https://github.com/snipe/snipe-it/commits?author=derdeagle "Code") | [<img src="https://avatars.githubusercontent.com/u/176950?v=4" width="110px;"/><br /><sub>Mike Frysinger</sub>](https://wh0rd.org/)<br />[💻](https://github.com/snipe/snipe-it/commits?author=vapier "Code") | [<img src="https://avatars.githubusercontent.com/u/22044358?v=4" width="110px;"/><br /><sub>ALPHA</sub>](https://github.com/AL4AL)<br />[💻](https://github.com/snipe/snipe-it/commits?author=AL4AL "Code") | [<img src="https://avatars.githubusercontent.com/u/1042587?v=4" width="110px;"/><br /><sub>FliegenKLATSCH</sub>](https://www.ifern.de)<br />[💻](https://github.com/snipe/snipe-it/commits?author=FliegenKLATSCH "Code") | [<img src="https://avatars.githubusercontent.com/u/442138?v=4" width="110px;"/><br /><sub>Jeremy Price</sub>](https://github.com/jerm)<br />[💻](https://github.com/snipe/snipe-it/commits?author=jerm "Code") | [<img src="https://avatars.githubusercontent.com/u/84392209?v=4" width="110px;"/><br /><sub>Toreg87</sub>](https://github.com/Toreg87)<br />[💻](https://github.com/snipe/snipe-it/commits?author=Toreg87 "Code") |
 | [<img src="https://avatars.githubusercontent.com/u/67638596?v=4" width="110px;"/><br /><sub>Matthew Nickson</sub>](https://github.com/Computroniks)<br />[💻](https://github.com/snipe/snipe-it/commits?author=Computroniks "Code") | [<img src="https://avatars.githubusercontent.com/u/1646397?v=4" width="110px;"/><br /><sub>Jethro Nederhof</sub>](https://jethron.id.au)<br />[💻](https://github.com/snipe/snipe-it/commits?author=jethron "Code") | [<img src="https://avatars.githubusercontent.com/u/23289826?v=4" width="110px;"/><br /><sub>Oskar Stenberg</sub>](https://github.com/01ste02)<br />[💻](https://github.com/snipe/snipe-it/commits?author=01ste02 "Code") | [<img src="https://avatars.githubusercontent.com/u/82208283?v=4" width="110px;"/><br /><sub>Robert-Azelis</sub>](https://github.com/Robert-Azelis)<br />[💻](https://github.com/snipe/snipe-it/commits?author=Robert-Azelis "Code") | [<img src="https://avatars.githubusercontent.com/u/60648387?v=4" width="110px;"/><br /><sub>Alexander William Smith</sub>](https://github.com/alwism)<br />[💻](https://github.com/snipe/snipe-it/commits?author=alwism "Code") | [<img src="https://avatars.githubusercontent.com/u/24418301?v=4" width="110px;"/><br /><sub>LEITWERK AG</sub>](https://www.leitwerk.de/)<br />[💻](https://github.com/snipe/snipe-it/commits?author=leitwerk-ag "Code") | [<img src="https://avatars.githubusercontent.com/u/1911435?v=4" width="110px;"/><br /><sub>Adam</sub>](http://www.aboutcher.co.uk)<br />[💻](https://github.com/snipe/snipe-it/commits?author=adamboutcher "Code") |
-| [<img src="https://avatars.githubusercontent.com/u/16104273?v=4" width="110px;"/><br /><sub>Ian</sub>](https://snksrv.com)<br />[💻](https://github.com/snipe/snipe-it/commits?author=sneak-it "Code") | [<img src="https://avatars.githubusercontent.com/u/4023909?v=4" width="110px;"/><br /><sub>Shao Yu-Lung (Allen)</sub>](http://blog.bestlong.idv.tw/)<br />[💻](https://github.com/snipe/snipe-it/commits?author=bestlong "Code") | [<img src="https://avatars.githubusercontent.com/u/76475453?v=4" width="110px;"/><br /><sub>Haxatron</sub>](https://github.com/Haxatron)<br />[💻](https://github.com/snipe/snipe-it/commits?author=Haxatron "Code") | [<img src="https://avatars.githubusercontent.com/u/3842948?v=4" width="110px;"/><br /><sub>Bradley Coudriet</sub>](http://bjcpgd.cias.rit.edu)<br />[💻](https://github.com/snipe/snipe-it/commits?author=exula "Code") |
+| [<img src="https://avatars.githubusercontent.com/u/16104273?v=4" width="110px;"/><br /><sub>Ian</sub>](https://snksrv.com)<br />[💻](https://github.com/snipe/snipe-it/commits?author=sneak-it "Code") | [<img src="https://avatars.githubusercontent.com/u/4023909?v=4" width="110px;"/><br /><sub>Shao Yu-Lung (Allen)</sub>](http://blog.bestlong.idv.tw/)<br />[💻](https://github.com/snipe/snipe-it/commits?author=bestlong "Code") | [<img src="https://avatars.githubusercontent.com/u/76475453?v=4" width="110px;"/><br /><sub>Haxatron</sub>](https://github.com/Haxatron)<br />[💻](https://github.com/snipe/snipe-it/commits?author=Haxatron "Code") | [<img src="https://avatars.githubusercontent.com/u/3842948?v=4" width="110px;"/><br /><sub>Bradley Coudriet</sub>](http://bjcpgd.cias.rit.edu)<br />[💻](https://github.com/snipe/snipe-it/commits?author=exula "Code") | [<img src="https://avatars.githubusercontent.com/u/21966173?v=4" width="110px;"/><br /><sub>Dalton Durst</sub>](https://daltondur.st)<br />[💻](https://github.com/snipe/snipe-it/commits?author=UniversalSuperBox "Code") | [<img src="https://avatars.githubusercontent.com/u/48162670?v=4" width="110px;"/><br /><sub>TenOfTens</sub>](https://github.com/TenOfTens)<br />[💻](https://github.com/snipe/snipe-it/commits?author=TenOfTens "Code") | [<img src="https://avatars.githubusercontent.com/u/917232?v=4" width="110px;"/><br /><sub>Simona Avornicesei</sub>](http://www.avornicesei.com)<br />[⚠️](https://github.com/snipe/snipe-it/commits?author=savornicesei "Tests") |
+| [<img src="https://avatars.githubusercontent.com/u/19945501?v=4" width="110px;"/><br /><sub>Yevhenii Huzii</sub>](https://github.com/QveenSi)<br />[💻](https://github.com/snipe/snipe-it/commits?author=QveenSi "Code") |
 <!-- ALL-CONTRIBUTORS-LIST:END -->

 This project follows the [all-contributors](https://github.com/kentcdodds/all-contributors) specification. Contributions of any kind welcome!
@@ -40,7 +40,7 @@ class FixDoubleEscape extends Command

        $tables = [
            '\App\Models\Asset' => ['name'],
-            '\App\Models\License' => ['name'],
+            '\App\Models\License' => ['name', 'license_name'],
            '\App\Models\Consumable' => ['name'],
            '\App\Models\Accessory' => ['name'],
            '\App\Models\Component' => ['name'],
@@ -53,7 +53,7 @@ class FixDoubleEscape extends Command
            '\App\Models\Group' => ['name'],
            '\App\Models\Department' => ['name'],
            '\App\Models\Location' => ['name'],
-            '\App\Models\User' => ['first_name', 'last_name'],
+            '\App\Models\User' => ['first_name', 'last_name', 'jobtitle'],
        ];

        $count = array();
@@ -69,10 +69,14 @@ class FixDoubleEscape extends Command
                    $count[$classname]['classname']++;
                    $count[$classname][$field] = 0;

-                    foreach($classname::where("$field",'LIKE','%&%')->get() as $row) {
-                        $this->info('Updating '.$field.' for '.$classname);
-                        $row->{$field} = html_entity_decode($row->{$field},ENT_QUOTES);
-                        $row->save();
+                    foreach($classname::where("$field",'LIKE','%;%')->get() as $row) {
+                       
+                        $fixed = html_entity_decode($row->{$field});
+                        if ($row->save()) {
+                            $this->info('Updating '.$field.' for '.$classname.' to '.$row->{$field}.' to '.$fixed);
+                        } else {
+                            $this->error('Could NOT update '.$field.' for '.$classname.' to '.$row->{$field}.' to '.$fixed.': '.$row->getErrors());
+                        }
                        $count[$classname][$field]++;

                    }
@@ -0,0 +1,59 @@
+<?php
+
+namespace App\Console\Commands;
+
+use Illuminate\Console\Command;
+
+class KillAllSessions extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'snipeit:global-logout  {--force : Skip the danger prompt; assuming you enter "y"} ';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'This command will destroy all web sessions on disk and will force a re-login for all users.';
+
+    /**
+     * Create a new command instance.
+     *
+     * @return void
+     */
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    /**
+     * Execute the console command.
+     *
+     * @return mixed
+     */
+    public function handle()
+    {
+
+        if (!$this->option('force') && !$this->confirm("****************************************************\nTHIS WILL FORCE A LOGIN FOR ALL LOGGED IN USERS.\n\nAre you SURE you wish to continue? ")) {
+            return $this->error("Session loss not confirmed");
+        }
+
+        $session_files = glob(storage_path("framework/sessions/*"));
+
+        $count = 0;
+        foreach ($session_files as $file) {
+
+            if (is_file($file))
+                unlink($file);
+                $count++;
+        }
+        \DB::table('users')->update(['remember_token' => null]);
+
+        $this->info($count. ' sessions cleared!');
+
+    }
+}
@@ -49,7 +49,7 @@ class LdapSync extends Command
        $ldap_result_last_name = Setting::getSettings()->ldap_lname_field;
        $ldap_result_first_name = Setting::getSettings()->ldap_fname_field;

-        $ldap_result_active_flag = Setting::getSettings()->ldap_active_flag_field;
+        $ldap_result_active_flag = Setting::getSettings()->ldap_active_flag;
        $ldap_result_emp_num = Setting::getSettings()->ldap_emp_num;
        $ldap_result_email = Setting::getSettings()->ldap_email;
        $ldap_result_phone = Setting::getSettings()->ldap_phone_field;
@@ -170,7 +170,6 @@ class LdapSync extends Command
        $pass = bcrypt($tmp_pass);

        for ($i = 0; $i < $results["count"]; $i++) {
-            if (empty($ldap_result_active_flag) || $results[$i][$ldap_result_active_flag][0] == "TRUE") {

                $item = array();
                $item["username"] = isset($results[$i][$ldap_result_username][0]) ? $results[$i][$ldap_result_username][0] : "";
@@ -192,6 +191,7 @@ class LdapSync extends Command


                $user = User::where('username', $item["username"])->first();
+
                if ($user) {
                    // Updating an existing user.
                    $item["createorupdate"] = 'updated';
@@ -199,7 +199,7 @@ class LdapSync extends Command
                    // Creating a new user.
                    $user = new User;
                    $user->password = $pass;
-                    $user->activated = 0;
+                    $user->activated = 1; // newly created users can log in by default, unless AD's UAC is in use, or an active flag is set (below)
                    $item["createorupdate"] = 'created';
                }

@@ -213,8 +213,19 @@ class LdapSync extends Command
                $user->country = $item["country"];
                $user->department_id = $department->id;

-                // Sync activated state for Active Directory.
-                if ( array_key_exists('useraccountcontrol', $results[$i]) ) {
+                if ( !empty($ldap_result_active_flag)) { // IF we have an 'active' flag set....
+                    // ....then *most* things that are truthy will activate the user. Anything falsey will deactivate them.
+                    // (Specifically, we don't handle a value of '0.0' correctly)
+                    $raw_value = @$results[$i][$ldap_result_active_flag][0];
+                    $filter_var = filter_var($raw_value, FILTER_VALIDATE_BOOLEAN, FILTER_NULL_ON_FAILURE);
+                    $boolean_cast = (bool)$raw_value;
+
+                    $user->activated = $filter_var ?? $boolean_cast; // if filter_var() was true or false, use that. If it's null, use the $boolean_cast
+
+                } elseif ( array_key_exists('useraccountcontrol', $results[$i]) ) {
+                    // ....otherwise, (ie if no 'active' LDAP flag is defined), IF the UAC setting exists,
+                    // ....then use the UAC setting on the account to determine can-log-in vs. cannot-log-in
+
                    /* The following is _probably_ the correct logic, but we can't use it because
                       some users may have been dependent upon the previous behavior, and this
                       could cause additional access to be available to users they don't want
@@ -240,16 +251,14 @@ class LdapSync extends Command
                    '262688', // 0x40220  NORMAL_ACCOUNT, PASSWD_NOTREQD, SMARTCARD_REQUIRED
                    '328192', // 0x50200  NORMAL_ACCOUNT, SMARTCARD_REQUIRED, DONT_EXPIRE_PASSWORD
                    '328224', // 0x50220  NORMAL_ACCOUNT, PASSWD_NOT_REQD, SMARTCARD_REQUIRED, DONT_EXPIRE_PASSWORD
+                    '4194816',// 0x400200 NORMAL_ACCOUNT, DONT_REQ_PREAUTH 
                    '4260352',// 0x410200 NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD, DONT_REQ_PREAUTH
                    '1049088',// 0x100200 NORMAL_ACCOUNT, NOT_DELEGATED
                  ];
                  $user->activated = ( in_array($results[$i]['useraccountcontrol'][0], $enabled_accounts) ) ? 1 : 0;
-                }

-                // If we're not using AD, and there isn't an activated flag set, activate all users
-                elseif (empty($ldap_result_active_flag)) {
-                  $user->activated = 1;
-                }
+                } /* implied 'else' here - leave the $user->activated flag alone. Newly-created accounts will be active.
+                   already-existing accounts will be however the administrator has set them */

                if ($item['ldap_location_override'] == true) {
                    $user->location_id = $item['location_id'];
@@ -279,7 +288,6 @@ class LdapSync extends Command
                }

                array_push($summary, $item);
-            }

        }

@@ -47,18 +47,18 @@ class MoveUploadsToNewDisk extends Command
        }
        $delete_local = $this->argument('delete_local');

-        $public_uploads['accessories'] = glob('public/accessories'."/*.*");
-        $public_uploads['assets'] = glob('public/assets'."/*.*");
-        $public_uploads['avatars'] = glob('public/avatars'."/*.*");
-        $public_uploads['categories'] = glob('public/categories'."/*.*");
-        $public_uploads['companies'] = glob('public/companies'."/*.*");
-        $public_uploads['components'] = glob('public/components'."/*.*");
-        $public_uploads['consumables'] = glob('public/consumables'."/*.*");
-        $public_uploads['departments'] = glob('public/departments'."/*.*");
-        $public_uploads['locations'] = glob('public/locations'."/*.*");
-        $public_uploads['manufacturers'] = glob('public/manufacturers'."/*.*");
-        $public_uploads['suppliers'] = glob('public/suppliers'."/*.*");
-        $public_uploads['assetmodels'] = glob('public/models'."/*.*");
+        $public_uploads['accessories'] = glob('public/uploads/accessories'."/*.*");
+        $public_uploads['assets'] = glob('public/uploads/assets'."/*.*");
+        $public_uploads['avatars'] = glob('public/uploads/avatars'."/*.*");
+        $public_uploads['categories'] = glob('public/uploads/categories'."/*.*");
+        $public_uploads['companies'] = glob('public/uploads/companies'."/*.*");
+        $public_uploads['components'] = glob('public/uploads/components'."/*.*");
+        $public_uploads['consumables'] = glob('public/uploads/consumables'."/*.*");
+        $public_uploads['departments'] = glob('public/uploads/departments'."/*.*");
+        $public_uploads['locations'] = glob('public/uploads/locations'."/*.*");
+        $public_uploads['manufacturers'] = glob('public/uploads/manufacturers'."/*.*");
+        $public_uploads['suppliers'] = glob('public/uploads/suppliers'."/*.*");
+        $public_uploads['assetmodels'] = glob('public/uploads/models'."/*.*");


        // iterate files
@@ -72,7 +72,7 @@ class MoveUploadsToNewDisk extends Command
                $filename = basename($public_upload[$i]);

                try  {
-                    Storage::disk('public')->put('uploads/'.public_type.'/'.$filename, file_get_contents($public_upload[$i]));
+                    Storage::disk('public')->put('uploads/'.$public_type.'/'.$filename, file_get_contents($public_upload[$i]));
                    $new_url = Storage::disk('public')->url('uploads/'.$public_type.'/'.$filename, $filename);
                    $this->info($type_count.'. PUBLIC: '.$filename.' was copied to '.$new_url);
                } catch (\Exception $e) {
@@ -103,7 +103,7 @@ class MoveUploadsToNewDisk extends Command
        $private_uploads['imports'] = glob('storage/private_uploads/imports'."/*.*");
        $private_uploads['licenses'] = glob('storage/private_uploads/licenses'."/*.*");
        $private_uploads['users'] = glob('storage/private_uploads/users'."/*.*");
-        $private_uploads['backups'] = glob('storage/private_uploads/users'."/*.*");
+        $private_uploads['backups'] = glob('storage/private_uploads/backups'."/*.*");


        foreach($private_uploads as $private_type => $private_upload)
@@ -14,7 +14,7 @@ class RestoreFromBackup extends Command
     * @var string
     */
    protected $signature = 'snipeit:restore 
-                                            {--force : Skip the danger prompt; assuming you hit "y"} 
+                                            {--force : Skip the danger prompt; assuming you enter "y"} 
                                            {filename : The zip file to be migrated}
                                            {--no-progress : Don\'t show a progress bar}';

@@ -8,6 +8,7 @@ use Illuminate\Foundation\Exceptions\Handler as ExceptionHandler;
 use App\Helpers\Helper;
 use Illuminate\Validation\ValidationException;
 use Log;
+use JsonException;


 class Handler extends ExceptionHandler
@@ -26,6 +27,7 @@ class Handler extends ExceptionHandler
        \Illuminate\Validation\ValidationException::class,
        \Intervention\Image\Exception\NotSupportedException::class,
        \League\OAuth2\Server\Exception\OAuthServerException::class,
+        JsonException::class
    ];

    /**
@@ -60,6 +62,12 @@ class Handler extends ExceptionHandler
            return redirect()->back()->with('error', trans('general.token_expired'));
        }

+        // Invalid JSON exception
+        // TODO: don't understand why we have to do this when we have the invalidJson() method, below, but, well, whatever
+        if ($e instanceof JsonException) {
+            return response()->json(Helper::formatStandardApiResponse('error', null, 'invalid JSON'), 422);
+        }
+

        // Handle Ajax requests that fail because the model doesn't exist
        if ($request->ajax() || $request->wantsJson()) {
@@ -76,10 +84,12 @@ class Handler extends ExceptionHandler
                switch ($e->getStatusCode()) {
                    case '404':
                       return response()->json(Helper::formatStandardApiResponse('error', null, $statusCode . ' endpoint not found'), 404);
-                    case '405':
+                    case '429':
+                        return response()->json(Helper::formatStandardApiResponse('error', null, 'Too many requests'), 429);
+                     case '405':
                        return response()->json(Helper::formatStandardApiResponse('error', null, 'Method not allowed'), 405);
                    default:
-                        return response()->json(Helper::formatStandardApiResponse('error', null, $statusCode), 405);
+                        return response()->json(Helper::formatStandardApiResponse('error', null, $statusCode), $statusCode);

                }
            }
@@ -78,6 +78,8 @@ class AccessoriesController extends Controller
        $accessory->qty                     = request('qty');
        $accessory->user_id                 = Auth::user()->id;
        $accessory->supplier_id             = request('supplier_id');
+        $accessory->notes                   = request('notes');
+

        $accessory = $request->handleImages($accessory);
        
@@ -140,6 +142,7 @@ class AccessoriesController extends Controller
        $accessory->purchase_cost           = Helper::ParseCurrency(request('purchase_cost'));
        $accessory->qty                     = request('qty');
        $accessory->supplier_id             = request('supplier_id');
+        $accessory->notes                   = request('notes');

        $accessory = $request->handleImages($accessory);

@@ -9,10 +9,21 @@ class ActionlogController extends Controller
 {
    public function displaySig($filename)
    {
+        // PHP doesn't let you handle file not found errors well with 
+        // file_get_contents, so we set the error reporting for just this class
+        error_reporting(0);
+
        $this->authorize('view', \App\Models\Asset::class);
-        $file = config('app.private_uploads') . '/signatures/' . $filename;
+        $file = config('app.private_uploads').'/signatures/'.$filename;
        $filetype = Helper::checkUploadIsImage($file);
-        $contents = file_get_contents($file);
-        return Response::make($contents)->header('Content-Type', $filetype);
+
+        $contents = file_get_contents($file, false, stream_context_create(['http' => ['ignore_errors' => true]]));
+        if ($contents === false) {
+            \Log::warn('File '.$file.' not found');
+            return false;
+        } else {
+            return Response::make($contents)->header('Content-Type', $filetype);
+        }
+       
    }
 }
@@ -39,7 +39,8 @@ class AccessoriesController extends Controller
                'notes',
                'created_at',
                'min_amt',
-                'company_id'
+                'company_id',
+                'notes',
            ];


@@ -69,6 +70,10 @@ class AccessoriesController extends Controller
            $accessories->where('location_id','=',$request->input('location_id'));
        }

+        if ($request->filled('notes')) {
+            $accessories->where('notes','=',$request->input('notes'));
+        }
+
        // Set the offset to the API call's offset, unless the offset is higher than the actual count of items in which
        // case we override with the actual count, so we should return 0 items.
        $offset = (($accessories) && ($request->get('offset') > $accessories->count())) ? $accessories->count() : $request->get('offset', 0);
@@ -33,6 +33,7 @@ class AssetMaintenancesController extends Controller
     */
    public function index(Request $request)
    {
+        $this->authorize('view', Asset::class);
        $maintenances = AssetMaintenance::with('asset', 'asset.model','asset.location', 'supplier', 'asset.company', 'admin');

        if ($request->filled('search')) {
@@ -101,6 +102,7 @@ class AssetMaintenancesController extends Controller
     */
    public function store(Request $request)
    {
+        $this->authorize('update', Asset::class);
        // create a new model instance
        $assetMaintenance = new AssetMaintenance();
        $assetMaintenance->supplier_id = $request->input('supplier_id');
@@ -153,6 +155,7 @@ class AssetMaintenancesController extends Controller
     */
    public function update(Request $request, $assetMaintenanceId = null)
    {
+        $this->authorize('update', Asset::class);
        // Check if the asset maintenance exists
        $assetMaintenance = AssetMaintenance::findOrFail($assetMaintenanceId);

@@ -216,6 +219,7 @@ class AssetMaintenancesController extends Controller
     */
    public function destroy($assetMaintenanceId)
    {
+        $this->authorize('update', Asset::class);
        // Check if the asset maintenance exists
        $assetMaintenance = AssetMaintenance::findOrFail($assetMaintenanceId);

@@ -241,6 +245,7 @@ class AssetMaintenancesController extends Controller
     */
    public function show($assetMaintenanceId)
    {
+        $this->authorize('view', Asset::class);
        $assetMaintenance = AssetMaintenance::findOrFail($assetMaintenanceId);
        if (!Company::isCurrentUserHasAccess($assetMaintenance->asset)) {
            return response()->json(Helper::formatStandardApiResponse('error', null, 'You cannot view a maintenance for that asset'));
@@ -234,6 +234,7 @@ class AssetModelsController extends Controller
    public function selectlist(Request $request)
    {

+        $this->authorize('view.selectlists');
        $assetmodels = AssetModel::select([
            'models.id',
            'models.name',
@@ -55,7 +55,7 @@ class AssetsController extends Controller
    {

        \Log::debug(Route::currentRouteName());
-        
+        $filter_non_deprecable_assets = false;

        /**
         * This looks MAD janky (and it is), but the AssetsController@index does a LOT of heavy lifting throughout the 
@@ -69,6 +69,7 @@ class AssetsController extends Controller
         * which would have been far worse of a mess. *sad face*  - snipe (Sept 1, 2021)
         */
        if (Route::currentRouteName()=='api.depreciation-report.index') {
+            $filter_non_deprecable_assets = true;
            $transformer = 'App\Http\Transformers\DepreciationReportTransformer';
            $this->authorize('reports.view');
        } else {
@@ -119,9 +120,24 @@ class AssetsController extends Controller
                'model.category', 'model.manufacturer', 'model.fieldset','supplier'); //it might be tempting to add 'assetlog' here, but don't. It blows up update-heavy users.

        
+        if ($filter_non_deprecable_assets) {
+            $non_deprecable_models = AssetModel::select('id')->whereNotNull('depreciation_id')->get();
+            $assets->InModelList($non_deprecable_models->toArray());
+        }
+        
        // These are used by the API to query against specific ID numbers.
        // They are also used by the individual searches on detail pages like
        // locations, etc.
+
+
+        // Search custom fields by column name
+        foreach ($all_custom_fields as $field) {
+            if ($request->filled($field->db_column_name())) {
+                $assets->where($field->db_column_name(), '=', $request->input($field->db_column_name()));
+            }
+        }
+
+
        if ($request->filled('status_id')) {
            $assets->where('assets.status_id', '=', $request->input('status_id'));
        }
@@ -844,13 +860,18 @@ class AssetsController extends Controller
            $asset->status_id =  $request->input('status_id');
        }

+        $checkin_at = null;
+        if ($request->filled('checkin_at')) {
+            $checkin_at = $request->input('checkin_at');
+        }
+
        if ($asset->save()) {
-            event(new CheckoutableCheckedIn($asset, $target, Auth::user(), $request->input('note')));
+            event(new CheckoutableCheckedIn($asset, $target, Auth::user(), $request->input('note'), $checkin_at));

            return response()->json(Helper::formatStandardApiResponse('success', ['asset'=> e($asset->asset_tag)], trans('admin/hardware/message.checkin.success')));
        }

-        return response()->json(Helper::formatStandardApiResponse('success', ['asset'=> e($asset->asset_tag)], trans('admin/hardware/message.checkin.error')));
+        return response()->json(Helper::formatStandardApiResponse('error', ['asset'=> e($asset->asset_tag)], trans('admin/hardware/message.checkin.error')));
    }


@@ -148,7 +148,7 @@ class CategoriesController extends Controller
     */
    public function selectlist(Request $request, $category_type = 'asset')
    {
-
+        $this->authorize('view.selectlists');
        $categories = Category::select([
            'id',
            'name',
@@ -159,7 +159,7 @@ class CompaniesController extends Controller
     */
    public function selectlist(Request $request)
    {
-
+        $this->authorize('view.selectlists');
        $companies = Company::select([
            'companies.id',
            'companies.name',
@@ -40,6 +40,7 @@ class ComponentsController extends Controller
                'purchase_cost',
                'qty',
                'image',
+                'notes',
            ];


@@ -62,6 +63,10 @@ class ComponentsController extends Controller
            $components->where('location_id','=',$request->input('location_id'));
        }

+        if ($request->filled('notes')) {
+            $components->where('notes','=',$request->input('notes'));
+        }
+
        // Set the offset to the API call's offset, unless the offset is higher than the actual count of items in which
        // case we override with the actual count, so we should return 0 items.
        $offset = (($components) && ($request->get('offset') > $components->count())) ? $components->count() : $request->get('offset', 0);
@@ -42,6 +42,7 @@ class ConsumablesController extends Controller
                'item_no', 
                'qty',
                'image',
+                'notes',
                ];


@@ -74,6 +75,10 @@ class ConsumablesController extends Controller
            $consumables->where('location_id','=',$request->input('location_id'));
        }

+        if ($request->filled('notes')) {
+            $consumables->where('notes','=',$request->input('notes'));
+        }
+

        // Set the offset to the API call's offset, unless the offset is higher than the actual count of items in which
        // case we override with the actual count, so we should return 0 items.
@@ -168,6 +168,7 @@ class DepartmentsController extends Controller
    public function selectlist(Request $request)
    {

+        $this->authorize('view.selectlists');
        $departments = Department::select([
            'id',
            'name',
@@ -82,6 +82,10 @@ class LicensesController extends Controller
            $licenses = $licenses->TextSearch($request->input('search'));
        }

+        if ($request->input('deleted')=='true') {
+            $licenses->onlyTrashed();
+        }
+

        // Set the offset to the API call's offset, unless the offset is higher than the actual count of items in which
        // case we override with the actual count, so we should return 0 items.
@@ -223,6 +223,8 @@ class LocationsController extends Controller
    public function selectlist(Request $request)
    {

+        $this->authorize('view.selectlists');
+
        $locations = Location::select([
            'locations.id',
            'locations.name',
@@ -155,6 +155,7 @@ class ManufacturersController extends Controller
    public function selectlist(Request $request)
    {

+        $this->authorize('view.selectlists');
        $manufacturers = Manufacturer::select([
            'id',
            'name',
@@ -196,7 +196,7 @@ class SettingsController extends Controller
                return response()->json(['message' => 'Success'], 200);

            } catch (\Exception $e) {
-                return response()->json(['message' => 'FARTS! Please check the channel name and webhook endpoint URL ('.$request->input('slack_endpoint').'). Slack responded with: '.$e->getMessage()], 400);
+                return response()->json(['message' => 'Please check the channel name and webhook endpoint URL ('.$request->input('slack_endpoint').'). Slack responded with: '.$e->getMessage()], 400);
            }
        
        //} 
@@ -30,6 +30,19 @@ class StatuslabelsController extends Controller
            $statuslabels = $statuslabels->TextSearch($request->input('search'));
        }

+        // if a status_type is passed, filter by that
+        if ($request->filled('status_type')) {
+            if (strtolower($request->input('status_type')) == 'pending') {
+                $statuslabels = $statuslabels->Pending();
+            } elseif (strtolower($request->input('status_type')) == 'archived') {
+                $statuslabels = $statuslabels->Archived();
+            } elseif (strtolower($request->input('status_type')) == 'deployable') {
+                $statuslabels = $statuslabels->Deployable();
+            } elseif (strtolower($request->input('status_type')) == 'undeployable') {
+                $statuslabels = $statuslabels->Undeployable();
+            }
+        }
+
        // Set the offset to the API call's offset, unless the offset is higher than the actual count of items in which
        // case we override with the actual count, so we should return 0 items.
        $offset = (($statuslabels) && ($request->get('offset') > $statuslabels->count())) ? $statuslabels->count() : $request->get('offset', 0);
@@ -155,6 +155,8 @@ class SuppliersController extends Controller
    public function selectlist(Request $request)
    {

+        $this->authorize('view.selectlists');
+
        $suppliers = Supplier::select([
            'id',
            'name',
@@ -7,6 +7,7 @@ use App\Http\Controllers\Controller;
 use App\Http\Requests\SaveUserRequest;
 use App\Http\Transformers\AccessoriesTransformer;
 use App\Http\Transformers\AssetsTransformer;
+use App\Http\Transformers\ConsumablesTransformer;
 use App\Http\Transformers\LicensesTransformer;
 use App\Http\Transformers\SelectlistTransformer;
 use App\Http\Transformers\UsersTransformer;
@@ -131,6 +132,26 @@ class UsersController extends Controller
            $users = $users->where('users.manager_id','=',$request->input('manager_id'));
        }

+        if ($request->filled('ldap_import')) {
+            $users = $users->where('ldap_import', '=', $request->input('ldap_import'));
+        }
+
+        if ($request->filled('assets_count')) {
+           $users->has('assets', '=', $request->input('assets_count'));
+        }
+
+        if ($request->filled('consumables_count')) {
+            $users->has('consumables', '=', $request->input('consumables_count'));
+        }
+
+        if ($request->filled('licenses_count')) {
+            $users->has('licenses', '=', $request->input('licenses_count'));
+        }
+
+        if ($request->filled('accessories_count')) {
+            $users->has('accessories', '=', $request->input('accessories_count'));
+        }
+
        if ($request->filled('search')) {
            $users = $users->TextSearch($request->input('search'));
        }
@@ -448,6 +469,24 @@ class UsersController extends Controller
        return (new AssetsTransformer)->transformAssets($assets, $assets->count(), $request);
    }

+
+    /**
+     * Return JSON containing a list of consumables assigned to a user.
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v3.0]
+     * @param $userId
+     * @return string JSON
+     */
+    public function consumables(Request $request, $id)
+    {
+        $this->authorize('view', User::class);
+        $this->authorize('view', Consumable::class);
+        $user = User::findOrFail($id);
+        $consumables = $user->consumables;
+        return (new ConsumablesTransformer)->transformConsumables($consumables, $consumables->count(), $request);
+    }
+
    /**
     * Return JSON containing a list of accessories assigned to a user.
     *
@@ -50,6 +50,7 @@ class AssetMaintenancesController extends Controller
    */
    public function index()
    {
+        $this->authorize('view', Asset::class);
        return view('asset_maintenances/index');
    }

@@ -66,6 +67,7 @@ class AssetMaintenancesController extends Controller
     */
    public function create()
    {
+        $this->authorize('update', Asset::class);
        $asset = null;

        if ($asset = Asset::find(request('asset_id'))) {
@@ -96,6 +98,7 @@ class AssetMaintenancesController extends Controller
    */
    public function store(Request $request)
    {
+        $this->authorize('update', Asset::class);
        // create a new model instance
        $assetMaintenance = new AssetMaintenance();
        $assetMaintenance->supplier_id = $request->input('supplier_id');
@@ -148,6 +151,7 @@ class AssetMaintenancesController extends Controller
    */
    public function edit($assetMaintenanceId = null)
    {
+        $this->authorize('update', Asset::class);
        // Check if the asset maintenance exists
        if (is_null($assetMaintenance = AssetMaintenance::find($assetMaintenanceId))) {
            // Redirect to the improvement management page
@@ -200,6 +204,7 @@ class AssetMaintenancesController extends Controller
     */
    public function update(Request $request, $assetMaintenanceId = null)
    {
+        $this->authorize('update', Asset::class);
        // Check if the asset maintenance exists
        if (is_null($assetMaintenance = AssetMaintenance::find($assetMaintenanceId))) {
            // Redirect to the asset maintenance management page
@@ -266,6 +271,7 @@ class AssetMaintenancesController extends Controller
    */
    public function destroy($assetMaintenanceId)
    {
+        $this->authorize('update', Asset::class);
        // Check if the asset maintenance exists
        if (is_null($assetMaintenance = AssetMaintenance::find($assetMaintenanceId))) {
            // Redirect to the asset maintenance management page
@@ -294,6 +300,8 @@ class AssetMaintenancesController extends Controller
    */
    public function show($assetMaintenanceId)
    {
+        $this->authorize('view', Asset::class);
+
        // Check if the asset maintenance exists
        if (is_null($assetMaintenance = AssetMaintenance::find($assetMaintenanceId))) {
            // Redirect to the asset maintenance management page
@@ -155,7 +155,6 @@ class AssetModelsController extends Controller
        $model->requestable         = $request->input('requestable', '0');


-
        $this->removeCustomFieldsDefaultValues($model);

        if ($request->input('custom_fieldset')=='') {
@@ -168,7 +167,6 @@ class AssetModelsController extends Controller
            }
        }

-
        if ($model->save()) {
            return redirect()->route("models.index")->with('success', trans('admin/models/message.update.success'));
        }
@@ -463,7 +461,9 @@ class AssetModelsController extends Controller
    private function assignCustomFieldsDefaultValues(AssetModel $model, array $defaultValues)
    {
        foreach ($defaultValues as $customFieldId => $defaultValue) {
-            if ($defaultValue) {
+            if(is_array($defaultValue)){
+                $model->defaultValues()->attach($customFieldId, ['default_value' => implode(', ', $defaultValue)]);
+            }elseif ($defaultValue) {
                $model->defaultValues()->attach($customFieldId, ['default_value' => $defaultValue]);
            }
        }
@@ -105,9 +105,9 @@ class AssetCheckinController extends Controller
            $asset->location_id =  e($request->get('location_id'));
        }

-        $checkin_at = date('Y-m-d');
-        if($request->filled('checkin_at')){
-            $checkin_at = $request->input('checkin_at');
+        $checkin_at = date('Y-m-d H:i:s');
+        if (($request->filled('checkin_at')) && ($request->get('checkin_at') != date('Y-m-d'))) {
+            $checkin_at = $request->get('checkin_at');
        }

        // Was the asset updated?
@@ -410,7 +410,23 @@ class AssetsController extends Controller
        return redirect()->route('hardware.index')->with('success', trans('admin/hardware/message.delete.success'));
    }

+    /**
+     * Searches the assets table by serial, and redirects if it finds one
+     *
+     * @author [A. Gianotto] [<snipe@snipe.net>]
+     * @since [v3.0]
+     * @return Redirect
+     */
+    public function getAssetBySerial(Request $request)
+    {
+        $topsearch = ($request->get('topsearch')=="true");

+        if (!$asset = Asset::where('serial', '=', $request->get('serial'))->first()) {
+            return redirect()->route('hardware.index')->with('error', trans('admin/hardware/message.does_not_exist'));
+        }
+        $this->authorize('view', $asset);
+        return redirect()->route('hardware.show', $asset->id)->with('topsearch', $topsearch);
+    }

    /**
     * Searches the assets table by asset tag, and redirects if it finds one
@@ -429,6 +445,8 @@ class AssetsController extends Controller
        $this->authorize('view', $asset);
        return redirect()->route('hardware.show', $asset->id)->with('topsearch', $topsearch);
    }
+
+
    /**
     * Return a QR code for the asset
     *
@@ -5,6 +5,7 @@ namespace App\Http\Controllers\Assets;
 use App\Helpers\Helper;
 use App\Http\Controllers\CheckInOutRequest;
 use App\Http\Controllers\Controller;
+use App\Models\Actionlog;
 use App\Models\Asset;
 use App\Models\Setting;
 use Illuminate\Http\Request;
@@ -121,6 +122,24 @@ class BulkAssetsController extends Controller
                    }
                }

+                $changed = [];
+                $asset = Asset::where('id' ,$assetId)->get();
+
+                foreach ($this->update_array as $key => $value) {
+                    if ($this->update_array[$key] != $asset->toArray()[0][$key]) {
+                        $changed[$key]['old'] = $asset->toArray()[0][$key];
+                        $changed[$key]['new'] = $this->update_array[$key];
+                    }
+                }
+
+                $logAction = new Actionlog();
+                $logAction->item_type = Asset::class;
+                $logAction->item_id = $assetId;
+                $logAction->created_at =  date("Y-m-d H:i:s");
+                $logAction->user_id = Auth::id();
+                $logAction->log_meta = json_encode($changed);
+                $logAction->logaction('update');
+
                DB::table('assets')
                    ->where('id', $assetId)
                    ->update($this->update_array);
@@ -87,6 +87,8 @@ class ForgotPasswordController extends Controller
            \Log::info('Password reset attempt: User '.$request->input('username').'failed with exception: '.$e );
        }

+        // Prevent timing attack to enumerate users.
+        usleep(500000 + random_int(0, 1500000));

        if ($response === \Password::RESET_LINK_SENT) {
            \Log::info('Password reset attempt: User '.$request->input('username').' WAS found, password reset sent');
@@ -75,6 +75,13 @@ class LoginController extends Controller
            return redirect()->intended('/');
        }

+        // If the environment is set to ALWAYS require SAML, go straight to the SAML route.
+        // We don't need to check other settings, as this should override those.
+        if (config('app.require_saml')) {
+            return redirect()->route('saml.login');
+        }
+
+
        if ($this->saml->isEnabled() && Setting::getSettings()->saml_forcelogin == "1" && !($request->has('nosaml') || $request->session()->has('error'))) {
            return redirect()->route('saml.login');
        }
@@ -197,6 +204,12 @@ class LoginController extends Controller
     */
    public function login(Request $request)
    {
+
+        //If the environment is set to ALWAYS require SAML, return access denied
+        if (config('app.require_saml')) {
+            return view('errors.403');
+        }
+
        if (Setting::getSettings()->login_common_disabled == "1") {
            return view('errors.403');
        }
@@ -363,7 +376,7 @@ class LoginController extends Controller
        if (Google2FA::verifyKey($user->two_factor_secret, $secret)) {
            $user->two_factor_enrolled = 1;
            $user->save();
-            $request->session()->put('2fa_authed', 'true');
+            $request->session()->put('2fa_authed', $user->id);
            return redirect()->route('home')->with('success', 'You are logged in!');
        }

@@ -78,6 +78,7 @@ class ComponentsController extends Controller
        $component->purchase_cost          = Helper::ParseCurrency($request->input('purchase_cost', null));
        $component->qty                    = $request->input('qty');
        $component->user_id                = Auth::id();
+        $component->notes                  = $request->input('notes');

        $component = $request->handleImages($component);

@@ -147,6 +148,7 @@ class ComponentsController extends Controller
        $component->purchase_date          = $request->input('purchase_date');
        $component->purchase_cost          = Helper::ParseCurrency(request('purchase_cost'));
        $component->qty                    = $request->input('qty');
+        $component->notes                  = $request->input('notes');

        $component = $request->handleImages($component);

@@ -78,6 +78,8 @@ class ConsumablesController extends Controller
        $consumable->purchase_cost          = Helper::ParseCurrency($request->input('purchase_cost'));
        $consumable->qty                    = $request->input('qty');
        $consumable->user_id                = Auth::id();
+        $consumable->notes                  = $request->input('notes');
+


        $consumable = $request->handleImages($consumable);
@@ -143,6 +145,7 @@ class ConsumablesController extends Controller
        $consumable->purchase_date          = $request->input('purchase_date');
        $consumable->purchase_cost          = Helper::ParseCurrency($request->input('purchase_cost'));
        $consumable->qty                    = Helper::ParseFloat($request->input('qty'));
+        $consumable->notes                  = $request->input('notes');

        $consumable = $request->handleImages($consumable);

@@ -133,12 +133,23 @@ class CustomFieldsController extends Controller

        $this->authorize('update', $field);

-        if ($field->fieldset()->detach($fieldset_id)) {
-            return redirect()->route('fieldsets.show', ['fieldset' => $fieldset_id])
-                ->with("success", trans('admin/custom_fields/message.field.delete.success'));
+        // Check that the field exists - this is mostly related to the demo, where we 
+        // rewrite the data every x minutes, so it's possible someone might be disassociating 
+        // a field from a fieldset just as we're wiping the database
+        if (($field) && ($fieldset_id)) {
+
+            if ($field->fieldset()->detach($fieldset_id)) {
+                return redirect()->route('fieldsets.show', ['fieldset' => $fieldset_id])
+                    ->with("success", trans('admin/custom_fields/message.field.delete.success'));
+            } else {
+                return redirect()->back()->withErrors(['message' => "Field is in use and cannot be deleted."]);
+            }  
+
        }

-        return redirect()->back()->withErrors(['message' => "Field is in-use"]);
+        return redirect()->back()->withErrors(['message' => "Error deleting field from fieldset"]);
+
+       
    }

    /**
@@ -113,6 +113,12 @@ class ProfileController extends Controller
     * @return View
     */
    public function api() {
+
+        // Make sure the self.api permission has been granted
+        if (!Gate::allows('self.api')) {
+            abort(403);
+        }
+        
        return view('account/api');
    }

@@ -8,6 +8,7 @@ use App\Http\Requests\ImageUploadRequest;
 use App\Http\Requests\SettingsSamlRequest;
 use App\Http\Requests\SetupUserRequest;
 use App\Models\Setting;
+use App\Models\Asset;
 use App\Models\User;
 use App\Notifications\FirstAdminNotification;
 use App\Notifications\MailTest;
@@ -621,6 +622,26 @@ class SettingsController extends Controller
            return redirect()->to('admin')->with('error', trans('admin/settings/message.update.error'));
        }

+        // Check if the audit interval has changed - if it has, we want to update ALL of the assets audit dates
+        if ($request->input('audit_interval') != $setting->audit_interval) {
+
+            // Be careful - this could be a negative number
+            $audit_diff_months = ((int)$request->input('audit_interval') - (int)($setting->audit_interval));
+            
+            // Grab all of the assets that have an existing next_audit_date
+            $assets = Asset::whereNotNull('next_audit_date')->get();
+
+            // Update all of the assets' next_audit_date values
+            foreach ($assets as $asset) {
+
+                if ($asset->next_audit_date != '') {
+                    $old_next_audit = new \DateTime($asset->next_audit_date);
+                    $asset->next_audit_date = $old_next_audit->modify($audit_diff_months.' month')->format('Y-m-d');
+                    $asset->forceSave();
+                }
+            }
+        } 
+
        $alert_email    = rtrim($request->input('alert_email'), ',');
        $alert_email    = trim($alert_email);
        $admin_cc_email = rtrim($request->input('admin_cc_email'), ',');
@@ -184,6 +184,7 @@ class SuppliersController extends Controller
     */
    public function show($supplierId = null)
    {
+        $this->authorize('view', Supplier::class);
        $supplier = Supplier::find($supplierId);

        if (isset($supplier->id)) {
@@ -109,12 +109,15 @@ class BulkUsersController extends Controller
        if (!$manager_conflict) {
            $this->conditionallyAddItem('manager_id');
        }
-
-
        // Save the updated info
        User::whereIn('id', $user_raw_array)
            ->where('id', '!=', Auth::id())->update($this->update_array);

+        if(array_key_exists('location_id', $this->update_array)){
+            Asset::where('assigned_type', User::class)
+                ->whereIn('assigned_to', $user_raw_array)
+                ->update(['location_id' => $this->update_array['location_id']]);
+        }
        // Only sync groups if groups were selected
        if ($request->filled('groups')) {
            foreach ($users as $user) {
@@ -484,7 +484,6 @@ class UsersController extends Controller
            $user->first_name = '';
            $user->last_name = '';
            $user->email = substr($user->email, ($pos = strpos($user->email, '@')) !== false ? $pos : 0);
-
            $user->id = null;

            // Get this user groups
@@ -24,6 +24,7 @@ class Kernel extends HttpKernel
        \Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull::class,
        \App\Http\Middleware\SecurityHeaders::class,
        \App\Http\Middleware\PreventBackHistory::class,
+        \Fruitcake\Cors\HandleCors::class,

    ];

@@ -38,14 +39,13 @@ class Kernel extends HttpKernel
            \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
            \App\Http\Middleware\VerifyCsrfToken::class,
            \App\Http\Middleware\CheckLocale::class,
+            \App\Http\Middleware\CheckUserIsActivated::class,
            \App\Http\Middleware\CheckForTwoFactor::class,
            \Laravel\Passport\Http\Middleware\CreateFreshApiToken::class,
            \App\Http\Middleware\AssetCountForSidebar::class,
        ],

        'api' => [
-            \Barryvdh\Cors\HandleCors::class,
-            'throttle:120,1',
            'auth:api',
        ],
    ];
@@ -32,7 +32,7 @@ class CheckForTwoFactor
        if ($settings = Setting::getSettings()) {
            if (Auth::check() && ($settings->two_factor_enabled != '')) {
                // This user is already 2fa-authed
-                if ($request->session()->get('2fa_authed')) {
+                if ($request->session()->get('2fa_authed')==Auth::user()->id) {
                    return $next($request);
                }

@@ -4,8 +4,9 @@ namespace App\Http\Middleware;

 use Closure;
 use Illuminate\Contracts\Auth\Guard;
+use Auth;

-class Authenticate
+class CheckUserIsActivated
 {
    /**
     * The Guard implementation.
@@ -34,14 +35,16 @@ class Authenticate
     */
    public function handle($request, Closure $next)
    {
-        if ($this->auth->guest()) {
-            if ($request->ajax()) {
-                return response('Unauthorized.', 401);
-            } else {
-                return redirect()->guest('login');
-            }
+
+        // If there is a user AND the user is NOT activated, send them to the login page
+        // This prevents people who still have active sessions logged in and their status gets toggled
+        // to inactive (aka unable to login)
+        if (($request->user()) && (!$request->user()->isActivated())) {
+            Auth::logout();
+            return redirect()->guest('login');
        }

        return $next($request);
+
    }
 }
@@ -8,6 +8,14 @@ abstract class Request extends FormRequest
 {
    protected $rules = [];

+    public function json($key = null, $default = null)
+    {
+        if ($this->ajax() || $this->wantsJson()) {
+            json_decode($this->getContent(), false, 512, JSON_THROW_ON_ERROR); // ignore output, just throw
+        }
+        return parent::json($key, $default);
+    }
+
    public function rules()
    {
        return $this->rules;
@@ -19,6 +19,22 @@ class ActionlogsTransformer
        return (new DatatablesTransformer)->transformDatatables($array, $total);
    }

+    private function clean_field($value)
+    {
+        // This object stuff is weird, and is used to make up for the fact that
+        // older data can get strangely formatted if an asset existed,
+        // then a new custom field is added, and the asset is saved again.
+        // It can result in funnily-formatted strings like:
+        //
+        // {"_snipeit_right_sized_fault_tolerant_localareanetwo_1":
+        // {"old":null,"new":{"value":"1579490695972","_snipeit_new_field_2":2,"_snipeit_new_field_3":"Monday, 20 January 2020 2:24:55 PM"}}
+        // so we have to walk down that next level
+        if(is_object($value) && isset($value->value)) {
+            return $this->clean_field($value->value);
+        }
+        return is_scalar($value) || is_null($value) ? e($value) : e(json_encode($value));
+    }
+
    public function transformActionlog (Actionlog $actionlog, $settings = null)
    {
        $icon = $actionlog->present()->icon();
@@ -31,45 +47,9 @@ class ActionlogsTransformer
            $meta_array = json_decode($actionlog->log_meta);

            if ($meta_array) {
-                foreach ($meta_array as $key => $value) {
-                    foreach ($value as $meta_key => $meta_value) {
-
-                        if (is_array($meta_value)) {
-                            foreach ($meta_value as $meta_value_key => $meta_value_value) {
-                                $clean_meta[$key][$meta_value_key] = e($meta_value_value);
-                            }
-                        } else {
-
-                            // This object stuff is weird, and is used to make up for the fact that
-                            // older data can get strangely formatted if an asset existed,
-                            // then a new custom field is added, and the asset is saved again.
-                            // It can result in funnily-formatted strings like:
-                            //
-                            // {"_snipeit_right_sized_fault_tolerant_localareanetwo_1":
-                            // {"old":null,"new":{"value":"1579490695972","_snipeit_new_field_2":2,"_snipeit_new_field_3":"Monday, 20 January 2020 2:24:55 PM"}}
-                            // so we have to walk down that next level
-
-                            if (is_object($meta_value)) {
-
-                                foreach ($meta_value as $meta_value_key => $meta_value_value) {
-
-                                    if ($meta_value_key == 'value') {
-                                        $clean_meta[$key]['old'] = null;
-                                        $clean_meta[$key]['new'] = e($meta_value->value);
-                                    } else {
-                                        $clean_meta[$meta_value_key]['old'] = null;
-                                        $clean_meta[$meta_value_key]['new'] = e($meta_value_value);
-                                    }
-                                }
-
-
-
-                            } else {
-                                $clean_meta[$key][$meta_key] = e($meta_value);
-                            }
-                        }
-
-                    }
+                foreach ($meta_array as $fieldname => $fieldata) {
+                    $clean_meta[$fieldname]['old'] = $this->clean_field($fieldata->old);
+                    $clean_meta[$fieldname]['new'] = $this->clean_field($fieldata->new);
                }

            }
@@ -118,6 +98,7 @@ class ActionlogsTransformer
            'action_date'   => ($actionlog->action_date) ? Helper::getFormattedDateObject($actionlog->action_date, 'datetime'): Helper::getFormattedDateObject($actionlog->created_at, 'datetime'),

        ];
+        //\Log::info("Clean Meta is: ".print_r($clean_meta,true));

        return $array;
    }
@@ -3,6 +3,7 @@ namespace App\Http\Transformers;

 use App\Helpers\Helper;
 use App\Models\Asset;
+use App\Models\Setting;
 use Gate;
 use Illuminate\Database\Eloquent\Collection;

@@ -20,6 +21,9 @@ class AssetsTransformer

    public function transformAsset(Asset $asset)
    {
+        // This uses the getSettings() method so we're pulling from the cache versus querying the settings on single asset
+        $setting = Setting::getSettings();
+
        $array = [
            'id' => (int) $asset->id,
            'name' => e($asset->name),
@@ -64,6 +68,8 @@ class AssetsTransformer
                'name'=> e($asset->defaultLoc->name)
            ]  : null,
            'image' => ($asset->getImageUrl()) ? $asset->getImageUrl() : null,
+            'qr' => ($setting->qr_code=='1') ? config('app.url').'/uploads/barcodes/qr-'.str_slug($asset->asset_tag).'-'.str_slug($asset->id).'.png' : null,
+            'alt_barcode' => ($setting->alt_barcode_enabled=='1') ? config('app.url').'/uploads/barcodes/'.str_slug($setting->alt_barcode).'-'.str_slug($asset->asset_tag).'.png' : null,
            'assigned_to' => $this->transformAssignedTo($asset),
            'warranty_months' =>  ($asset->warranty_months > 0) ? e($asset->warranty_months . ' ' . trans('admin/hardware/form.months')) : null,
            'warranty_expires' => ($asset->warranty_months > 0) ?  Helper::getFormattedDateObject($asset->warranty_expires, 'date') : null,
@@ -43,6 +43,7 @@ class ComponentsTransformer
                'id' => (int) $component->company->id,
                'name' => e($component->company->name)
            ] : null,
+            'notes' => ($component->notes) ? e($component->notes) : null,
            'created_at' => Helper::getFormattedDateObject($component->created_at, 'datetime'),
            'updated_at' => Helper::getFormattedDateObject($component->updated_at, 'datetime'),
            'user_can_checkout' =>  ($component->numRemaining() > 0) ? 1 : 0,
@@ -37,6 +37,7 @@ class ConsumablesTransformer
            'purchase_cost'  => Helper::formatCurrencyOutput($consumable->purchase_cost),
            'purchase_date'  => Helper::getFormattedDateObject($consumable->purchase_date, 'date'),
            'qty'           => (int) $consumable->qty,
+            'notes'         => ($consumable->notes) ? e($consumable->notes) : null,
            'created_at' => Helper::getFormattedDateObject($consumable->created_at, 'datetime'),
            'updated_at' => Helper::getFormattedDateObject($consumable->updated_at, 'datetime'),
        ];
@@ -45,7 +45,9 @@ class LicensesTransformer
            'category' =>  ($license->category) ? ['id' => (int)  $license->category->id,'name'=> e($license->category->name)] : null,
            'created_at' => Helper::getFormattedDateObject($license->created_at, 'datetime'),
            'updated_at' => Helper::getFormattedDateObject($license->updated_at, 'datetime'),
+            'deleted_at' => Helper::getFormattedDateObject($license->deleted_at, 'datetime'),
            'user_can_checkout' => (bool) ($license->free_seats_count > 0),
+
        ];

        $permissions_array['available_actions'] = [
@@ -71,7 +71,7 @@ class AssetImporter extends ItemImporter
            $this->log("No Matching Asset, Creating a new one");
            $asset = new Asset;
        }
-
+        $this->item['notes'] = $this->findCsvMatch($row, 'asset_notes');
        $this->item['image'] = $this->findCsvMatch($row, "image");
        $this->item['requestable'] = $this->fetchHumanBoolean($this->findCsvMatch($row, "requestable"));;
        $asset->requestable =  $this->fetchHumanBoolean($this->findCsvMatch($row, "requestable"));
@@ -177,7 +177,7 @@ class ItemImporter extends Importer
     */
    public function createOrFetchAssetModel(array $row)
    {
-
+        $condition = array();
        $asset_model_name = $this->findCsvMatch($row, "asset_model");
        $asset_modelNumber = $this->findCsvMatch($row, "model_number");
        // TODO: At the moment, this means  we can't update the model number if the model name stays the same.
@@ -189,8 +189,16 @@ class ItemImporter extends Importer
        } elseif ((empty($asset_model_name))  && (empty($asset_modelNumber))) {
            $asset_model_name ='Unknown';
        }
+
+        if ((!empty($asset_model_name)) && (empty($asset_modelNumber))) {
+            $condition[] = ['name', '=', $asset_model_name];
+        } elseif ((!empty($asset_model_name)) && (!empty($asset_modelNumber))) {
+            $condition[] = ['name', '=', $asset_model_name];
+            $condition[] = ['model_number', '=', $asset_modelNumber];
+        }
+
        $editingModel = $this->updating;
-        $asset_model = AssetModel::where(['name' => $asset_model_name, 'model_number' => $asset_modelNumber])->first();
+        $asset_model = AssetModel::where($condition)->first();

        if ($asset_model) {
            if (!$this->updating) {
@@ -200,7 +208,12 @@ class ItemImporter extends Importer
            $this->log("Matching Model found, updating it.");
            $item = $this->sanitizeItemForStoring($asset_model, $editingModel);
            $item['name'] = $asset_model_name;
-            $item['model_number'] = $asset_modelNumber;
+            $item['notes'] = $this->findCsvMatch($row, 'model_notes');
+            
+            if(!empty($asset_modelNumber)){
+                $item['model_number'] = $asset_modelNumber;
+            }
+            
            $asset_model->update($item);
            $asset_model->save();
            $this->log("Asset Model Updated");
@@ -212,6 +225,7 @@ class ItemImporter extends Importer
        $item = $this->sanitizeItemForStoring($asset_model, $editingModel);
        $item['name'] = $asset_model_name;
        $item['model_number'] = $asset_modelNumber;
+        $item['notes'] = $this->findCsvMatch($row, 'model_notes');

        $asset_model->fill($item);
        $item = null;
@@ -32,7 +32,6 @@ class LicenseImporter extends ItemImporter
    {
        $editingLicense = false;
        $license = License::where('name', $this->item['name'])
-                    ->where('serial', $this->item['serial'])
                    ->first();
        if ($license) {
            if (!$this->updating) {
@@ -47,14 +46,22 @@ class LicenseImporter extends ItemImporter
            $license = new License;
        }
        $asset_tag = $this->item['asset_tag'] = $this->findCsvMatch($row, 'asset_tag'); // used for checkout out to an asset.
-        $this->item['expiration_date'] = $this->findCsvMatch($row, 'expiration_date');
+        
+        $this->item["expiration_date"] = null;
+        if ($this->findCsvMatch($row, "expiration_date")!='') {
+            $this->item["expiration_date"] = date("Y-m-d 00:00:01", strtotime($this->findCsvMatch($row, "expiration_date")));
+        }
        $this->item['license_email'] = $this->findCsvMatch($row, "license_email");
        $this->item['license_name'] = $this->findCsvMatch($row, "license_name");
        $this->item['maintained'] = $this->findCsvMatch($row, 'maintained');
        $this->item['purchase_order'] = $this->findCsvMatch($row, 'purchase_order');
        $this->item['reassignable'] = $this->findCsvMatch($row, 'reassignable');
        $this->item['seats'] = $this->findCsvMatch($row, 'seats');
-        $this->item['termination_date'] = $this->findCsvMatch($row, 'termination_date');
+        
+        $this->item["termination_date"] = null;
+        if ($this->findCsvMatch($row, "termination_date")!='') {
+            $this->item["termination_date"] = date("Y-m-d 00:00:01", strtotime($this->findCsvMatch($row, "termination_date")));
+        }

        if ($editingLicense) {
            $license->update($this->sanitizeItemForUpdating($license));
@@ -52,6 +52,7 @@ class UserImporter extends ItemImporter
        $this->item['city'] = $this->findCsvMatch($row, 'city');
        $this->item['state'] = $this->findCsvMatch($row, 'state');
        $this->item['country'] = $this->findCsvMatch($row, 'country');
+        $this->item['zip'] = $this->findCsvMatch($row, 'zip');
        $this->item['activated'] =  ($this->fetchHumanBoolean($this->findCsvMatch($row, 'activated')) == 1) ? '1' : 0;
        $this->item['employee_num'] = $this->findCsvMatch($row, 'employee_num');
        $this->item['department_id'] = $this->createOrFetchDepartment($this->findCsvMatch($row, 'department'));
@@ -35,7 +35,7 @@ class Accessory extends SnipeModel
     * 
     * @var array
     */
-    protected $searchableAttributes = ['name', 'model_number', 'order_number', 'purchase_date'];
+    protected $searchableAttributes = ['name', 'model_number', 'order_number', 'purchase_date', 'notes'];

    /**
     * The relations and their attributes that should be included when searching the model.
@@ -92,7 +92,8 @@ class Accessory extends SnipeModel
        'image',
        'qty',
        'min_amt',
-        'requestable'
+        'requestable',
+        'notes',
    ];


@@ -30,7 +30,7 @@ class Actionlog extends SnipeModel
     * 
     * @var array
     */
-    protected $searchableAttributes = ['action_type', 'note', 'log_meta'];
+    protected $searchableAttributes = ['action_type', 'note', 'log_meta','user_id'];

    /**
     * The relations and their attributes that should be included when searching the model.
@@ -38,7 +38,8 @@ class Actionlog extends SnipeModel
     * @var array
     */
    protected $searchableRelations = [
-        'company' => ['name']
+        'company' => ['name'],
+        'user' => ['first_name','last_name','username'],
    ];

    /**
@@ -185,10 +185,19 @@ class Asset extends Depreciable
            $model = AssetModel::find($this->model_id);

            if (($model) && ($model->fieldset)) {
+
+                foreach ($model->fieldset->fields as $field){
+                    if($field->format == 'BOOLEAN'){
+                        $this->{$field->db_column} = filter_var($this->{$field->db_column}, FILTER_VALIDATE_BOOLEAN);
+                    }
+                }
+
                $this->rules += $model->fieldset->validation_rules();
            }
        }

+
+
        return parent::save($params);
    }

@@ -665,13 +674,15 @@ class Asset extends Depreciable
     */
    public static function getExpiringWarrantee($days = 30)
    {
+        $days = (is_null($days)) ? 30 : $days;
+        
        return Asset::where('archived', '=', '0')
            ->whereNotNull('warranty_months')
            ->whereNotNull('purchase_date')
            ->whereNull('deleted_at')
            ->whereRaw(\DB::raw('DATE_ADD(`purchase_date`,INTERVAL `warranty_months` MONTH) <= DATE(NOW() + INTERVAL '
                                 . $days
-                                 . ' DAY) AND DATE_ADD(`purchase_date`,INTERVAL `warranty_months` MONTH) > NOW()'))
+                                 . ' DAY) AND DATE_ADD(`purchase_date`, INTERVAL `warranty_months` MONTH) > NOW()'))
            ->orderBy('purchase_date', 'ASC')
            ->get();
    }
@@ -814,7 +825,9 @@ class Asset extends Depreciable
     */
    public function checkin_email()
    {
-        return $this->model->category->checkin_email;
+        if (($this->model) && ($this->model->category)) {
+            return $this->model->category->checkin_email;
+        }
    }

    /**
@@ -60,6 +60,7 @@ class Component extends SnipeModel
        'order_number',
        'qty',
        'serial',
+        'notes',
    ];

    use Searchable;
@@ -69,7 +70,7 @@ class Component extends SnipeModel
     * 
     * @var array
     */
-    protected $searchableAttributes = ['name', 'order_number', 'serial', 'purchase_cost', 'purchase_date'];
+    protected $searchableAttributes = ['name', 'order_number', 'serial', 'purchase_cost', 'purchase_date', 'notes'];

    /**
     * The relations and their attributes that should be included when searching the model.
@@ -69,7 +69,8 @@ class Consumable extends SnipeModel
        'purchase_date',
        'qty',
        'min_amt',
-        'requestable'
+        'requestable',
+        'notes',
    ];

    use Searchable;
@@ -79,7 +80,7 @@ class Consumable extends SnipeModel
     * 
     * @var array
     */
-    protected $searchableAttributes = ['name', 'order_number', 'purchase_cost', 'purchase_date', 'item_no', 'model_number'];
+    protected $searchableAttributes = ['name', 'order_number', 'purchase_cost', 'purchase_date', 'item_no', 'model_number', 'notes'];

    /**
     * The relations and their attributes that should be included when searching the model.
@@ -627,6 +627,7 @@ class License extends Depreciable
     */
    public static function getExpiringLicenses($days = 60)
    {
+        $days = (is_null($days)) ? 60 : $days;

        return License::whereNotNull('expiration_date')
        ->whereNull('deleted_at')
@@ -115,6 +115,10 @@ trait Loggable

        $log->location_id = null;
        $log->note = $note;
+        $log->action_date = $action_date;
+        if (! $log->action_date) {
+            $log->action_date = date('Y-m-d H:i:s');
+        }

        if (Auth::user()) {
            $log->user_id = Auth::user()->id;
@@ -121,6 +121,18 @@ class Statuslabel extends SnipeModel
            ->where('deployable', '=', 1);
    }

+    /**
+     * Query builder scope for undeployable status types
+     *
+     * @return \Illuminate\Database\Query\Builder Modified query builder
+     */
+    public function scopeUndeployable()
+    {
+        return $this->where('pending', '=', 0)
+            ->where('archived', '=', 0)
+            ->where('deployable', '=', 0);
+    }
+
    /**
     * Helper function to determine type attributes
     *
@@ -70,7 +70,6 @@ class User extends SnipeModel implements AuthenticatableContract, AuthorizableCo
     * @var array
     */

-    // 'username' => 'required|string|min:1|unique:users,username,NULL,id,deleted_at,NULL',
    protected $rules = [
        'first_name'              => 'required|string|min:1',
        'username'                => 'required|string|min:1|unique_undeleted',
@@ -306,7 +305,7 @@ class User extends SnipeModel implements AuthenticatableContract, AuthorizableCo
     */
    public function consumables()
    {
-        return $this->belongsToMany('\App\Models\Consumable', 'consumables_users', 'assigned_to', 'consumable_id')->withPivot('id')->withTrashed();
+        return $this->belongsToMany('\App\Models\Consumable', 'consumables_users', 'assigned_to', 'consumable_id')->withPivot('id', 'created_at')->withTrashed();
    }

    /**
@@ -318,7 +317,7 @@ class User extends SnipeModel implements AuthenticatableContract, AuthorizableCo
     */
    public function licenses()
    {
-        return $this->belongsToMany('\App\Models\License', 'license_seats', 'assigned_to', 'license_id')->withPivot('id');
+        return $this->belongsToMany('\App\Models\License', 'license_seats', 'assigned_to', 'license_id')->withPivot('id', 'created_at');
    }

    /**
@@ -109,7 +109,14 @@ class AccessoryPresenter extends Presenter
                "sortable" => true,
                "visible" => false,
                "title" => trans('general.order_number'),
-            ],[
+            ], [
+                "field" => "notes",
+                "searchable" => true,
+                "sortable" => true,
+                "visible" => false,
+                "title" => trans('general.notes'),
+                "formatter" => "notesFormatter"
+            ], [
                "field" => "change",
                "searchable" => false,
                "sortable" => false,
@@ -104,7 +104,14 @@ class ComponentPresenter extends Presenter
                "title" => trans('general.purchase_cost'),
                "visible" => true,
                "footerFormatter" => 'sumFormatter',
-            ],
+            ], [
+                "field" => "notes",
+                "searchable" => true,
+                "sortable" => true,
+                "visible" => false,
+                "title" => trans('general.notes'),
+                "formatter" => "notesFormatter"
+            ]
        ];

        $layout[] = [
@@ -118,13 +118,20 @@ class ConsumablePresenter extends Presenter
                "visible" => true,
                "footerFormatter" => 'sumFormatter',
            ],[
+                "field" => "notes",
+                "searchable" => true,
+                "sortable" => true,
+                "visible" => false,
+                "title" => trans('general.notes'),
+                "formatter" => "notesFormatter"
+            ], [
                "field" => "change",
                "searchable" => false,
                "sortable" => false,
                "visible" => true,
                "title" => trans('general.change'),
                "formatter" => "consumablesInOutFormatter",
-            ], [
+            ],  [
                "field" => "actions",
                "searchable" => false,
                "sortable" => false,
@@ -43,6 +43,17 @@ class AppServiceProvider extends ServiceProvider
                \Log::warning("'APP_FORCE_TLS' is set to true, but 'APP_URL' does not start with 'https://'. Will not force TLS on connections.");
            }
        }
+
+        // TODO - isn't it somehow 'gauche' to check the environment directly; shouldn't we be using config() somehow?
+        if ( ! env('APP_ALLOW_INSECURE_HOSTS')) {  // unless you set APP_ALLOW_INSECURE_HOSTS, you should PROHIBIT forging domain parts of URL via Host: headers
+            $url_parts = parse_url(config('app.url'));
+            if ($url_parts && array_key_exists('scheme', $url_parts) && array_key_exists('host', $url_parts)) { // check for the *required* parts of a bare-minimum URL
+                \URL::forceRootUrl(config('app.url'));
+            } else {
+                \Log::error("Your APP_URL in your .env is misconfigured - it is: ".config('app.url').". Many things will work strangely unless you fix it.");
+            }
+        }
+
        Schema::defaultStringLength(191);
        Asset::observe(AssetObserver::class);
        Accessory::observe(AccessoryObserver::class);
@@ -156,6 +156,8 @@ class AuthServiceProvider extends ServiceProvider
            return $user->hasAccess('self.checkout_assets');
        });

+        // This is largely used to determine whether to display the gear icon sidenav 
+        // in the left-side navigation
        Gate::define('backend.interact', function ($user) {
            return $user->can('view', Statuslabel::class)
                || $user->can('view', AssetModel::class)
@@ -168,7 +170,30 @@ class AuthServiceProvider extends ServiceProvider
                || $user->can('view', Manufacturer::class)
                || $user->can('view', CustomField::class)
                || $user->can('view', CustomFieldset::class)                
-                || $user->can('view', Depreciation::class);
+                || $user->can('view', Depreciation::class); 
+        });
+
+
+        // This  determines whether or not an API user should be able to get the selectlists.
+        // This can seem a little confusing, since view properties may not have been granted
+        // to the logged in API user, but creating assets, licenses, etc won't work 
+        // if the user can't view and interact with the select lists.
+        Gate::define('view.selectlists', function ($user) {
+            return $user->can('update', Asset::class) 
+                 || $user->can('create', Asset::class)    
+                 || $user->can('checkout', Asset::class)
+                 || $user->can('checkin', Asset::class)
+                 || $user->can('audit', Asset::class)       
+                 || $user->can('update', License::class)   
+                 || $user->can('create', License::class)   
+                 || $user->can('update', Component::class)
+                 || $user->can('create', Component::class)   
+                 || $user->can('update', Consumable::class)   
+                 || $user->can('create', Consumable::class)   
+                 || $user->can('update', Accessory::class)
+                 || $user->can('create', Accessory::class)   
+                 || $user->can('update', User::class)
+                 || $user->can('create', User::class);  
        });
    }
 }
@@ -47,6 +47,7 @@ class LdapAd extends LdapAdConfiguration
      '262688', // 0x40220  NORMAL_ACCOUNT, PASSWD_NOTREQD, SMARTCARD_REQUIRED
      '328192', // 0x50200  NORMAL_ACCOUNT, SMARTCARD_REQUIRED, DONT_EXPIRE_PASSWORD
      '328224', // 0x50220  NORMAL_ACCOUNT, PASSWD_NOT_REQD, SMARTCARD_REQUIRED, DONT_EXPIRE_PASSWORD
+      '4194816',// 0x400200 NORMAL_ACCOUNT, DONT_REQ_PREAUTH
      '4260352',// 0x410200 NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD, DONT_REQ_PREAUTH
      '1049088',// 0x100200 NORMAL_ACCOUNT, NOT_DELEGATED
      '1114624',// 0x110200 NORMAL_ACCOUNT, NOT_DELEGATED, DONT_EXPIRE_PASSWORD
@@ -20,7 +20,6 @@
    "adldap2/adldap2": "^10.2",
    "alek13/slack": "^1.12",
    "bacon/bacon-qr-code": "^1.0",
-    "barryvdh/laravel-cors": "^0.11.3",
    "barryvdh/laravel-debugbar": "^3.2",
    "doctrine/cache": "^1.10",
    "doctrine/common": "^2.12",
@@ -28,9 +27,10 @@
    "doctrine/inflector": "^1.3",
    "doctrine/instantiator": "^1.3",
    "eduardokum/laravel-mail-auto-embed": "^1.0",
-    "enshrined/svg-sanitize": "^0.13.3",
+    "enshrined/svg-sanitize": "^0.15.0",
    "erusev/parsedown": "^1.7",
    "fideloper/proxy": "^4.3",
+    "fruitcake/laravel-cors": "^2.2",
    "guzzlehttp/guzzle": "^6.5",
    "intervention/image": "^2.5",
    "javiereguiluz/easyslugger": "^1.0",
@@ -70,6 +70,7 @@
    "overtrue/phplint": "^2.2",
    "phpunit/php-token-stream": "^3.1",
    "phpunit/phpunit": "^8.5",
+    "roave/security-advisories": "dev-latest",
    "squizlabs/php_codesniffer": "^3.5",
    "symfony/css-selector": "^4.4",
    "symfony/dom-crawler": "^4.4"
@@ -255,7 +255,20 @@ return [
    'enable_csp' => env('ENABLE_CSP', false),


+    /*
+     |--------------------------------------------------------------------------
+     | Require SAML Login
+     |--------------------------------------------------------------------------
+     |
+     | Disable the ability to login via form login, and disables the 'nosaml'
+     | workaround. It requires all logins to process via SAML login.
+     | (This is for high security setups. If your SAML configuration is not
+     | working, this option should be set to false. This option is not needed
+     | to successfully configure SAML authentication.)
+     |
+     */

+    'require_saml' => env('REQUIRE_SAML', false),

    /*
    |--------------------------------------------------------------------------
@@ -412,4 +425,15 @@ return [

    ],

+    /*
+    |--------------------------------------------------------------------------
+    | API Throttling
+    |--------------------------------------------------------------------------
+    |
+    | This value determines the number of API requests permitted per minute
+    |
+    */
+
+    'api_throttle_per_minute' => env('API_THROTTLE_PER_MINUTE', 120),
+
 ];
@@ -37,12 +37,13 @@ return [
    |
    */
   
-    'supportsCredentials' => false,
-    'allowedOrigins' => $allowed_origins,
-    'allowedOriginsPatterns' => [],
-    'allowedHeaders' => ['*'],
-    'allowedMethods' => ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],
-    'exposedHeaders' => [],
-    'maxAge' => 0,
+    'supports_credentials' => false,
+    'allowed_origins' => $allowed_origins,
+    'allowed_origins_patterns' => [],
+    'allowed_headers' => ['*'],
+    'allowed_methods' => ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],
+    'exposed_headers' => [],
+    'max_age' => 0,
+    'paths' => ['api/*', 'sanctum/csrf-cookie'],

 ];
@@ -1,10 +1,10 @@
 <?php
 return array (
-  'app_version' => 'v5.3.7',
-  'full_app_version' => 'v5.3.7 - build 6587-gcf14a0222',
-  'build_version' => '6587',
+  'app_version' => 'v5.4.2',
+  'full_app_version' => 'v5.4.2 - build 6805-g5314ef97e',
+  'build_version' => '6805',
  'prerelease_version' => '',
-  'hash_version' => 'gcf14a0222',
-  'full_hash' => 'v5.3.7-19-gcf14a0222',
+  'hash_version' => 'g5314ef97e',
+  'full_hash' => 'v5.4.2-52-g5314ef97e',
  'branch' => 'master',
 );
@@ -22,12 +22,12 @@ class UpdateGroupFieldForReporting extends Migration {
        
        if (Schema::hasTable('permission_groups')) {

-            Group::where('id', 1)->update(['permissions' => '{"users-poop":1,"reports":1}']);
-            Group::where('id', 2)->update(['permissions' => '{"users-pop":1,"reports":1}']);
+            Group::where('id', 1)->update(['permissions' => '{"users-foo":1,"reports":1}']);
+            Group::where('id', 2)->update(['permissions' => '{"users-foo":1,"reports":1}']);

        } elseif (Schema::hasTable('groups')) {
-            DB::update('update '.DB::getTablePrefix().'groups set permissions = ? where id = ?', ['{"admin-farts":1,"users":1,"reports":1}', 1]);
-            DB::update('update '.DB::getTablePrefix().'groups set permissions = ? where id = ?', ['{"users-farts":1,"reports":1}', 2]);
+            DB::update('update '.DB::getTablePrefix().'groups set permissions = ? where id = ?', ['{"admin-foo":1,"users":1,"reports":1}', 1]);
+            DB::update('update '.DB::getTablePrefix().'groups set permissions = ? where id = ?', ['{"users-foo":1,"reports":1}', 2]);
        }

    }
@@ -14,13 +14,14 @@ class CreateCustomFieldCustomFieldset extends Migration {
 	{
 		Schema::create('custom_field_custom_fieldset', function(Blueprint $table)
 		{
+            $table->bigIncrements('id');
 			$table->integer('custom_field_id');
 			$table->integer('custom_fieldset_id');
-
 			$table->integer('order');
 			$table->boolean('required');
-      $table->engine = 'InnoDB';
+            $table->engine = 'InnoDB';
 		});
+
 	}

 	/**
@@ -23,7 +23,7 @@ class AddLdapFieldsToSettings extends Migration {
 			$table->string('ldap_username_field')->nullable()->default('samaccountname');
 			$table->string('ldap_lname_field')->nullable()->default('sn');
 			$table->string('ldap_fname_field')->nullable()->default('givenname');
-			$table->string('ldap_auth_filter_query')->nullable()->default('uid=samaccountname');
+			$table->string('ldap_auth_filter_query')->nullable()->default('uid=');
 			$table->integer('ldap_version')->nullable()->default(3);
 			$table->string('ldap_active_flag')->nullable()->default(NULL);
 			$table->string('ldap_emp_num')->nullable()->default(NULL);
@@ -13,20 +13,22 @@ class CreateCheckoutAcceptancesTable extends Migration
     */
    public function up()
    {
-        Schema::create('checkout_acceptances', function (Blueprint $table) {
-            $table->increments('id');
+        if (!Schema::hasTable('checkout_acceptances')) {
+            Schema::create('checkout_acceptances', function (Blueprint $table) {
+                $table->increments('id');

-            $table->morphs('checkoutable');
-            $table->integer('assigned_to_id')->nullable();
+                $table->morphs('checkoutable');
+                $table->integer('assigned_to_id')->nullable();

-            $table->string('signature_filename')->nullable();
+                $table->string('signature_filename')->nullable();

-            $table->timestamp('accepted_at')->nullable();
-            $table->timestamp('declined_at')->nullable();
+                $table->timestamp('accepted_at')->nullable();
+                $table->timestamp('declined_at')->nullable();

-            $table->timestamps();
-            $table->softDeletes();
-        });
+                $table->timestamps();
+                $table->softDeletes();
+            });
+        }
    }

    /**
@@ -36,6 +38,8 @@ class CreateCheckoutAcceptancesTable extends Migration
     */
    public function down()
    {
-        Schema::dropIfExists('checkout_acceptances');
+        if (Schema::hasTable('checkout_acceptances')) {
+            Schema::dropIfExists('checkout_acceptances');
+        }
    }
 }
@@ -12,14 +12,15 @@ class AddKitsLicensesTable extends Migration {
 	 */
 	public function up()
 	{
-		//
-		Schema::create('kits_licenses', function ($table) {
-            $table->increments('id');
-            $table->integer('kit_id')->nullable()->default(NULL); 
-            $table->integer('license_id')->nullable()->default(NULL);    
-            $table->integer('quantity')->default(1);
-            $table->timestamps();
-        });
+		if (!Schema::hasTable('kits_licenses')) {
+			Schema::create('kits_licenses', function ($table) {
+				$table->increments('id');
+				$table->integer('kit_id')->nullable()->default(NULL); 
+				$table->integer('license_id')->nullable()->default(NULL);    
+				$table->integer('quantity')->default(1);
+				$table->timestamps();
+			});
+		}
 	}

 	/**
@@ -29,8 +30,9 @@ class AddKitsLicensesTable extends Migration {
 	 */
 	public function down()
 	{
-		//
-		Schema::drop('kits_licenses');
+		if (Schema::hasTable('kits_licenses')) {
+			Schema::drop('kits_licenses');
+		}
 	}

 }
@@ -12,13 +12,14 @@ class AddKitsTable extends Migration {
 	 */
 	public function up()
 	{
-		//
-		 Schema::create('kits', function ($table) {
-            $table->increments('id');
-            $table->string('name')->nullable()->default(NULL);
-            $table->timestamps();
-            $table->engine = 'InnoDB';
-        });
+		if (!Schema::hasTable('kits')) {
+			Schema::create('kits', function ($table) {
+				$table->increments('id');
+				$table->string('name')->nullable()->default(NULL);
+				$table->timestamps();
+				$table->engine = 'InnoDB';
+			});
+		}

 	}

@@ -29,8 +30,9 @@ class AddKitsTable extends Migration {
 	 */
 	public function down()
 	{
-		//
-		Schema::drop('kits');
+		if (Schema::hasTable('kits')) {
+			Schema::drop('kits');
+		}

 	}

@@ -12,14 +12,15 @@ class AddKitsModelsTable extends Migration {
 	 */
 	public function up()
 	{
-		//
-		Schema::create('kits_models', function ($table) {
-            $table->increments('id');
-            $table->integer('kit_id')->nullable()->default(NULL); 
-            $table->integer('model_id')->nullable()->default(NULL);    
-            $table->integer('quantity')->default(1);
-            $table->timestamps();
-        });
+		if (!Schema::hasTable('kits_models')) {
+			Schema::create('kits_models', function ($table) {
+				$table->increments('id');
+				$table->integer('kit_id')->nullable()->default(NULL); 
+				$table->integer('model_id')->nullable()->default(NULL);    
+				$table->integer('quantity')->default(1);
+				$table->timestamps();
+			});
+		}
 	}

 	/**
@@ -29,8 +30,9 @@ class AddKitsModelsTable extends Migration {
 	 */
 	public function down()
 	{
-		//
-		Schema::drop('kits_models');
+		if (Schema::hasTable('kits_models')) {
+			Schema::drop('kits_models');
+		}
 	}

 }
@@ -13,14 +13,15 @@ class AddKitsConsumablesTable extends Migration
     */
    public function up()
    {
-        //
-        Schema::create('kits_consumables', function ($table) {
-            $table->increments('id');
-            $table->integer('kit_id')->nullable()->default(NULL); 
-            $table->integer('consumable_id')->nullable()->default(NULL);    
-            $table->integer('quantity')->default(1);
-            $table->timestamps();
-        });
+        if (!Schema::hasTable('kits_consumables')) {
+            Schema::create('kits_consumables', function ($table) {
+                $table->increments('id');
+                $table->integer('kit_id')->nullable()->default(NULL); 
+                $table->integer('consumable_id')->nullable()->default(NULL);    
+                $table->integer('quantity')->default(1);
+                $table->timestamps();
+            });
+        }
    }

    /**
@@ -30,7 +31,8 @@ class AddKitsConsumablesTable extends Migration
     */
    public function down()
    {
-        //
-		Schema::drop('kits_consumables');
+        if (Schema::hasTable('kits_consumables')) {
+		    Schema::drop('kits_consumables');
+        }
    }
 }
@@ -13,14 +13,15 @@ class AddKitsAccessoriesTable extends Migration
     */
    public function up()
    {
-        //
-        Schema::create('kits_accessories', function ($table) {
-            $table->increments('id');
-            $table->integer('kit_id')->nullable()->default(NULL); 
-            $table->integer('accessory_id')->nullable()->default(NULL);    
-            $table->integer('quantity')->default(1);
-            $table->timestamps();
-        });
+        if (!Schema::hasTable('kits_accessories')) {
+            Schema::create('kits_accessories', function ($table) {
+                $table->increments('id');
+                $table->integer('kit_id')->nullable()->default(NULL); 
+                $table->integer('accessory_id')->nullable()->default(NULL);    
+                $table->integer('quantity')->default(1);
+                $table->timestamps();
+            });
+        }
    }

    /**
@@ -30,7 +31,8 @@ class AddKitsAccessoriesTable extends Migration
     */
    public function down()
    {
-        //
-		Schema::drop('kits_accessories');
+        if (Schema::hasTable('kits_accessories')) {
+		    Schema::drop('kits_accessories');
+        }
    }
 }
@@ -0,0 +1,32 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+use App\Models\Setting;
+
+class BlankOutLdapActiveFlag extends Migration
+{
+    /**
+     * Run the migrations.
+     *
+     * @return void
+     */
+    public function up()
+    {
+        if ($s = Setting::getSettings()) {
+            $s->ldap_active_flag = '';
+            $s->save();
+        }
+    }
+    
+    /**
+     * Reverse the migrations.
+     *
+     * @return void
+     */
+    public function down()
+    {
+        //
+    }
+}
@@ -0,0 +1,34 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+class AddNotesToAccessories extends Migration
+{
+    /**
+     * Run the migrations.
+     *
+     * @return void
+     */
+    public function up()
+    {
+        Schema::table('accessories', function (Blueprint $table) {
+            $table->text("notes")->nullable()->default(null);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     *
+     * @return void
+     */
+    public function down()
+    {
+        Schema::table('accessories', function (Blueprint $table) {
+            if (Schema::hasColumn('accessories', 'notes')) {
+                $table->dropColumn('notes');
+            }
+        });
+    }
+}
@@ -0,0 +1,34 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+class AddNotesToComponents extends Migration
+{
+    /**
+     * Run the migrations.
+     *
+     * @return void
+     */
+    public function up()
+    {
+        Schema::table('components', function (Blueprint $table) {
+            $table->text("notes")->nullable()->default(null);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     *
+     * @return void
+     */
+    public function down()
+    {
+        Schema::table('components', function (Blueprint $table) {
+            if (Schema::hasColumn('components', 'notes')) {
+                $table->dropColumn('notes');
+            }
+        });
+    }
+}
@@ -0,0 +1,34 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+class AddNotesToConsumables extends Migration
+{
+    /**
+     * Run the migrations.
+     *
+     * @return void
+     */
+    public function up()
+    {
+        Schema::table('consumables', function (Blueprint $table) {
+            $table->text("notes")->nullable()->default(null);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     *
+     * @return void
+     */
+    public function down()
+    {
+        Schema::table('consumables', function (Blueprint $table) {
+            if (Schema::hasColumn('consumables', 'notes')) {
+                $table->dropColumn('notes');
+            }
+        });
+    }
+}
@@ -0,0 +1,39 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+class AddPrimaryKeyToCustomFieldsPivot extends Migration
+{
+    /**
+     * Run the migrations.
+     *
+     * @return void
+     */
+    public function up()
+    {
+
+        // Check if the ID primary key already exists, if not, add it
+        Schema::table('custom_field_custom_fieldset', function (Blueprint $table) {
+            if (!Schema::hasColumn('custom_field_custom_fieldset', 'id')) {
+                $table->bigIncrements('id')->first();
+            }
+        });
+
+    }
+
+    /**
+     * Reverse the migrations.
+     *
+     * @return void
+     */
+    public function down()
+    {
+        Schema::table('custom_field_custom_fieldset', function (Blueprint $table) {
+            if (Schema::hasColumn('custom_field_custom_fieldset', 'id')) {
+                $table->dropColumn('id');
+            }
+        });
+    }
+}
@@ -0,0 +1,2 @@
+[mysqldump]
+column-statistics=0
@@ -2693,9 +2693,9 @@
      "integrity": "sha1-EQPWvADPv6jPyaJZmrUYxVZD2j8="
    },
    "bootstrap-table": {
-      "version": "1.19.1",
-      "resolved": "https://registry.npmjs.org/bootstrap-table/-/bootstrap-table-1.19.1.tgz",
-      "integrity": "sha512-WvV+l1AI/C+zThaKmfHmi/IuayVNB0qdFyEhFx1jyZhO0oLtNJNANkCR3rvJf6Dkh72dsLElxpE/bzK9seEQLA=="
+      "version": "1.18.3",
+      "resolved": "https://registry.npmjs.org/bootstrap-table/-/bootstrap-table-1.18.3.tgz",
+      "integrity": "sha512-/eFLkldDlNFi37qC/d9THfRVxMUGD34E8fQBFtXJLDHLBOVKWDTq7BV+udoP7k3FfCEyhM1jWQnQ0rMQdBv//w=="
    },
    "brace-expansion": {
      "version": "1.1.11",
@@ -4233,7 +4233,7 @@
    "deep-equal": {
      "version": "1.1.1",
      "resolved": "https://registry.npmjs.org/deep-equal/-/deep-equal-1.1.1.tgz",
-      "integrity": "sha1-tcmMlCzv+vfLBR4k4UNKJaLmB2o=",
+      "integrity": "sha512-yd9c5AdiqVcR+JjcwUQb9DkhJc8ngNr0MahEBGvDiJw8puWab2yZlh+nkasOnZP+EGTAP6rRp2JzJhJZzvNF8g==",
      "dev": true,
      "requires": {
        "is-arguments": "^1.0.4",
@@ -16238,9 +16238,9 @@
      "integrity": "sha1-G+i3twTdOFcVJwiu+x1KSzpp+zM="
    },
    "jquery-ui": {
-      "version": "1.13.0",
-      "resolved": "https://registry.npmjs.org/jquery-ui/-/jquery-ui-1.13.0.tgz",
-      "integrity": "sha512-Osf7ECXNTYHtKBkn9xzbIf9kifNrBhfywFEKxOeB/OVctVmLlouV9mfc2qXCp6uyO4Pn72PXKOnj09qXetopCw==",
+      "version": "1.13.1",
+      "resolved": "https://registry.npmjs.org/jquery-ui/-/jquery-ui-1.13.1.tgz",
+      "integrity": "sha512-2VlU59N5P4HaumDK1Z3XEVjSvegFbEOQRgpHUBaB2Ak98Axl3hFhJ6RFcNQNuk9SfL6WxIbuLst8dW/U56NSiA==",
      "requires": {
        "jquery": ">=1.8.0 <4.0.0"
      }
@@ -32,7 +32,7 @@
    "bootstrap-colorpicker": "^2.5.3",
    "bootstrap-datepicker": "^1.9.0",
    "bootstrap-less": "^3.3.8",
-    "bootstrap-table": "^1.19.1",
+    "bootstrap-table": "1.18.x",
    "chart.js": "^2.9.4",
    "css-loader": "^3.6.0",
    "ekko-lightbox": "^5.1.1",
@@ -41,7 +41,7 @@
    "imagemin": "^5.3.1",
    "jquery-form-validator": "^2.3.79",
    "jquery-slimscroll": "^1.3.8",
-    "jquery-ui": "^1.13.0",
+    "jquery-ui": "^1.13.1",
    "jquery-ui-bundle": "^1.12.1",
    "jquery.iframe-transport": "^1.0.0",
    "less": "^3.13.1",
--- a/Show More
+++ b/Show More