From 57d6760484a62aa4a4d750b6df7965533fc08497 Mon Sep 17 00:00:00 2001 From: RhodeCode Admin Date: Tue, 12 Oct 2021 14:48:14 +0200 Subject: [PATCH 01/22] version: bumped to 4.27.0 --- .bumpversion.cfg | 2 +- pkgs/python-packages.nix | 2 +- rhodecode/VERSION | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.bumpversion.cfg b/.bumpversion.cfg index 95efd974..c85f4573 100644 --- a/.bumpversion.cfg +++ b/.bumpversion.cfg @@ -1,5 +1,5 @@ [bumpversion] -current_version = 4.26.0 +current_version = 4.27.0 message = release: Bump version {current_version} to {new_version} [bumpversion:file:rhodecode/VERSION] diff --git a/pkgs/python-packages.nix b/pkgs/python-packages.nix index 9a867d97..08172723 100644 --- a/pkgs/python-packages.nix +++ b/pkgs/python-packages.nix @@ -1883,7 +1883,7 @@ self: super: { }; }; "rhodecode-enterprise-ce" = super.buildPythonPackage { - name = "rhodecode-enterprise-ce-4.26.0"; + name = "rhodecode-enterprise-ce-4.27.0"; buildInputs = [ self."pytest" self."py" diff --git a/rhodecode/VERSION b/rhodecode/VERSION index 47312771..238cd7ab 100644 --- a/rhodecode/VERSION +++ b/rhodecode/VERSION @@ -1 +1 @@ -4.26.0 \ No newline at end of file +4.27.0 \ No newline at end of file From 37a751bc317476811bb385b5b43f9f186a92ca80 Mon Sep 17 00:00:00 2001 From: RhodeCode Admin Date: Fri, 29 Oct 2021 14:42:31 +0200 Subject: [PATCH 02/22] users: enable full edit mode for super admins. - We'll enable the users to change their names via external auth for rename cases. --- rhodecode/apps/admin/views/users.py | 6 +++++- rhodecode/lib/_vendor/redis_lock/__init__.py | 2 +- rhodecode/lib/helpers.py | 3 +-- .../templates/admin/users/user_edit_profile.mako | 11 ++++++++++- 4 files changed, 17 insertions(+), 5 deletions(-) diff --git a/rhodecode/apps/admin/views/users.py b/rhodecode/apps/admin/views/users.py index 536b5399..3ccd5be9 100644 --- a/rhodecode/apps/admin/views/users.py +++ b/rhodecode/apps/admin/views/users.py @@ -311,13 +311,16 @@ class UsersView(UserAppView): available_languages=available_languages, old_data={'user_id': user_id, 'email': c.user.email})() + + c.edit_mode = self.request.POST.get('edit') == '1' form_result = {} old_values = c.user.get_api_data() try: form_result = _form.to_python(dict(self.request.POST)) skip_attrs = ['extern_name'] # TODO: plugin should define if username can be updated - if c.extern_type != "rhodecode": + + if c.extern_type != "rhodecode" and not c.edit_mode: # forbid updating username for external accounts skip_attrs.append('username') @@ -485,6 +488,7 @@ class UsersView(UserAppView): c.extern_type = c.user.extern_type c.extern_name = c.user.extern_name c.perm_user = c.user.AuthUser(ip_addr=self.request.remote_addr) + c.edit_mode = self.request.GET.get('edit') == '1' defaults = c.user.get_dict() defaults.update({'language': c.user.user_data.get('language')}) diff --git a/rhodecode/lib/_vendor/redis_lock/__init__.py b/rhodecode/lib/_vendor/redis_lock/__init__.py index 6da5858e..f9900c67 100644 --- a/rhodecode/lib/_vendor/redis_lock/__init__.py +++ b/rhodecode/lib/_vendor/redis_lock/__init__.py @@ -221,7 +221,7 @@ class Lock(object): """ logger = loggers["acquire"] - logger.debug("Getting acquire on %r ...", self._name) + logger.debug("Getting blocking: %s acquire on %r ...", blocking, self._name) if self._held: owner_id = self.get_owner_id() diff --git a/rhodecode/lib/helpers.py b/rhodecode/lib/helpers.py index ea670467..5d586b02 100644 --- a/rhodecode/lib/helpers.py +++ b/rhodecode/lib/helpers.py @@ -1679,9 +1679,8 @@ def process_patterns(text_string, repo_name, link_format='html', active_entries= errors = [] new_text = text_string - log.debug('Got %s entries to process', len(active_entries)) + log.debug('Got %s pattern entries to process', len(active_entries)) for uid, entry in active_entries.items(): - log.debug('found issue tracker entry with uid %s', uid) if not (entry['pat'] and entry['url']): log.debug('skipping due to missing data') diff --git a/rhodecode/templates/admin/users/user_edit_profile.mako b/rhodecode/templates/admin/users/user_edit_profile.mako index 28d1b1ba..16a04298 100644 --- a/rhodecode/templates/admin/users/user_edit_profile.mako +++ b/rhodecode/templates/admin/users/user_edit_profile.mako @@ -12,7 +12,10 @@ ${h.secure_form(h.route_path('user_update', user_id=c.user.user_id), class_='form', request=request)} <% readonly = None %> <% disabled = "" %> - %if c.extern_type != 'rhodecode': + % if c.edit_mode: + ${h.hidden('edit', '1')} + % endif + %if c.extern_type != 'rhodecode' and not c.edit_mode: <% readonly = "readonly" %> <% disabled = " disabled" %>
@@ -40,6 +43,12 @@
${h.text('username', class_='%s medium' % disabled, readonly=readonly)} +
+ % if c.extern_type != 'rhodecode' and c.is_super_admin: +

+ ${_('Super-admin can edit this field by entering ')} edit mode +

+ % endif
From 2c268b6026a3abbc6ee4ae7185bdae227568332f Mon Sep 17 00:00:00 2001 From: RhodeCode Admin Date: Fri, 29 Oct 2021 14:42:59 +0200 Subject: [PATCH 03/22] pyroutes: register status healthcheck in routes. --- rhodecode/public/js/rhodecode/routes.js | 1 + 1 file changed, 1 insertion(+) diff --git a/rhodecode/public/js/rhodecode/routes.js b/rhodecode/public/js/rhodecode/routes.js index bcd2da84..b9d42eb0 100644 --- a/rhodecode/public/js/rhodecode/routes.js +++ b/rhodecode/public/js/rhodecode/routes.js @@ -244,6 +244,7 @@ function registerRCRoutes() { pyroutes.register('notifications_show_all', '/_admin/notifications', []); pyroutes.register('notifications_update', '/_admin/notifications/%(notification_id)s/update', ['notification_id']); pyroutes.register('ops_error_test', '/_admin/ops/error', []); + pyroutes.register('ops_healthcheck', '/_admin/ops/status', []); pyroutes.register('ops_ping', '/_admin/ops/ping', []); pyroutes.register('ops_redirect_test', '/_admin/ops/redirect', []); pyroutes.register('plugin_admin_chat', '/_admin/plugin_admin_chat/%(action)s', ['action']); From 6661b23cd5840884f44b29c49c20afd487eabb7d Mon Sep 17 00:00:00 2001 From: RhodeCode Admin Date: Thu, 18 Nov 2021 15:18:21 +0100 Subject: [PATCH 04/22] security: fixed self-xss on archive download page. --- rhodecode/apps/repository/views/repo_files.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rhodecode/apps/repository/views/repo_files.py b/rhodecode/apps/repository/views/repo_files.py index 7dd4cdab..f1f52792 100644 --- a/rhodecode/apps/repository/views/repo_files.py +++ b/rhodecode/apps/repository/views/repo_files.py @@ -381,7 +381,7 @@ class RepoFilesView(RepoAppView): try: at_path = commit.get_node(at_path).path or default_at_path except Exception: - return Response(_('No node at path {} for this repository').format(at_path)) + return Response(_('No node at path {} for this repository').format(h.escape(at_path))) # path sha is part of subdir path_sha = '' From b0f3ddc60077b4af7dea14098d797bad4086b3d6 Mon Sep 17 00:00:00 2001 From: RhodeCode Admin Date: Wed, 1 Dec 2021 13:53:38 +0100 Subject: [PATCH 05/22] system-info: expose env variables --- rhodecode/apps/admin/views/system_info.py | 38 ++++++++++++++++++- .../admin/settings/settings_system.mako | 19 ++++++++++ 2 files changed, 55 insertions(+), 2 deletions(-) diff --git a/rhodecode/apps/admin/views/system_info.py b/rhodecode/apps/admin/views/system_info.py index 75276860..47512b67 100644 --- a/rhodecode/apps/admin/views/system_info.py +++ b/rhodecode/apps/admin/views/system_info.py @@ -20,8 +20,7 @@ import logging import urllib2 - - +import os import rhodecode from rhodecode.apps._base import BaseAppView @@ -40,6 +39,40 @@ class AdminSystemInfoSettingsView(BaseAppView): c = self._get_local_tmpl_context() return c + def get_env_data(self): + black_list = [ + 'NIX_LDFLAGS', + 'NIX_CFLAGS_COMPILE', + 'propagatedBuildInputs', + 'propagatedNativeBuildInputs', + 'postInstall', + 'buildInputs', + 'buildPhase', + 'preShellHook', + 'preShellHook', + 'preCheck', + 'preBuild', + 'postShellHook', + 'postFixup', + 'postCheck', + 'nativeBuildInputs', + 'installPhase', + 'installCheckPhase', + 'checkPhase', + 'configurePhase', + 'shellHook' + ] + secret_list = [ + 'RHODECODE_USER_PASS' + ] + + for k, v in sorted(os.environ.items()): + if k in black_list: + continue + if k in secret_list: + v = '*****' + yield k, v + @LoginRequired() @HasPermissionAllDecorator('hg.admin') def settings_system_info(self): @@ -55,6 +88,7 @@ class AdminSystemInfoSettingsView(BaseAppView): snapshot = str2bool(self.request.params.get('snapshot')) c.rhodecode_update_url = UpdateModel().get_update_url() + c.env_data = self.get_env_data() server_info = system_info.get_system_info(self.request.environ) for key, val in server_info.items(): diff --git a/rhodecode/templates/admin/settings/settings_system.mako b/rhodecode/templates/admin/settings/settings_system.mako index ebd93ab4..0bb12ff1 100644 --- a/rhodecode/templates/admin/settings/settings_system.mako +++ b/rhodecode/templates/admin/settings/settings_system.mako @@ -62,6 +62,25 @@
+
+
+

${_('Env Variables')}

+
+
+ + + + % for env_key, env_val in c.env_data: + + + + + % endfor +
${env_key}${env_val}
+ +
+
+