kobotoolbox/kpi 2.026.37d

on GitHub

assetsList: make asset list pagination stable (#7744)

Paging through a long project list with the API no longer returns some
projects twice while skipping others.

When an integration read a project list page by page, projects that had
been updated at the exact same moment (for example by one bulk change)
could swap places between pages. Some showed up twice and others were
never returned. The list now always comes back in the same order, page
after page.

The project list can also be sorted by creation date with
ordering=date_created. In that order, new projects only ever land at
the end, and editing a project while an integration is reading the list
doesn't move it.

bulkSubmission: [breaking] require login and submission permissions (#7770)

Bulk submission uploads now require a logged-in user with permission to
add submissions to the project.

The legacy bulk submission upload (a zip of submissions sent to a user's
bulk submission page) now requires the user to be logged in, only
accepts uploads to the user's own account, and checks that the user can
add submissions to each project the zip contains data for. The
command-line import tool used by administrators gets the same permission
checks and now accepts current KoboCollect folders and Enketo exports.

👷 Description for instance maintainers

• import_tools and import management commands are removed (they
  could not run anymore).
• import_instances works again: ./manage.py import_instances <username> <path>. <path> can be a zip file (ODK/KoboCollect folder
  zipped, Enketo offline export), or a directory (ODK/KoboCollect project
  folder, legacy odk folder, or a directory of zip files). Submissions
  are checked against the permissions of <username>.

connectProjects: list correct projects (#7781)

Organization owners and admins can now pick any of the organization's
sharing-enabled projects in Connect Projects.

markdownx: restrict uploads to superusers (#7771)

Image uploads in the admin message editors are now limited to
superusers, and SVG files are no longer accepted.

repostgres: restore attachments instead of crashing (#7691)

The submission recovery tool for server administrators no longer fails
on submissions with attached files.

When the tool restored a submission with attachments (photos, audio,
etc.), it stopped with an error and restored nothing. It now restores
the files with the submission's original date and counts them in the
project's storage usage.