From 7de15715e082532bd2175d49b9af1c4decf10e78 Mon Sep 17 00:00:00 2001 From: Marcin Kuzminski Date: Sat, 11 Nov 2017 10:29:31 +0100 Subject: [PATCH 1/9] ldap: increase timeouts and timelimits for operations --- rhodecode/authentication/plugins/auth_ldap.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/rhodecode/authentication/plugins/auth_ldap.py b/rhodecode/authentication/plugins/auth_ldap.py index 3630a39a..0e9b258c 100644 --- a/rhodecode/authentication/plugins/auth_ldap.py +++ b/rhodecode/authentication/plugins/auth_ldap.py @@ -234,9 +234,9 @@ class AuthLdap(object): '/etc/openldap/cacerts') ldap.set_option(ldap.OPT_REFERRALS, ldap.OPT_OFF) ldap.set_option(ldap.OPT_RESTART, ldap.OPT_ON) - ldap.set_option(ldap.OPT_TIMEOUT, 20) - ldap.set_option(ldap.OPT_NETWORK_TIMEOUT, 10) - ldap.set_option(ldap.OPT_TIMELIMIT, 15) + ldap.set_option(ldap.OPT_NETWORK_TIMEOUT, 60 * 10) + ldap.set_option(ldap.OPT_TIMEOUT, 60 * 10) + if self.TLS_KIND != 'PLAIN': ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, self.TLS_REQCERT) server = ldap.initialize(self.LDAP_SERVER) From 7a512a4788acbfaac0158a0a604201cdfc820fc4 Mon Sep 17 00:00:00 2001 From: Marcin Kuzminski Date: Sat, 11 Nov 2017 16:43:45 +0100 Subject: [PATCH 2/9] ldap: fixed regression in extracting settings after library updates. - somehow we now got '' defaulted to None which changed the behaviour. --- rhodecode/authentication/base.py | 5 ++++- rhodecode/authentication/plugins/auth_ldap.py | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/rhodecode/authentication/base.py b/rhodecode/authentication/base.py index f18f1fee..04e8940b 100644 --- a/rhodecode/authentication/base.py +++ b/rhodecode/authentication/base.py @@ -218,7 +218,10 @@ class RhodeCodeAuthPluginBase(object): else: plugin_settings = SettingsModel().get_all_settings() - return plugin_settings.get(full_name) or default + if full_name in plugin_settings: + return plugin_settings[full_name] + else: + return default def create_or_update_setting(self, name, value): """ diff --git a/rhodecode/authentication/plugins/auth_ldap.py b/rhodecode/authentication/plugins/auth_ldap.py index 0e9b258c..97282320 100644 --- a/rhodecode/authentication/plugins/auth_ldap.py +++ b/rhodecode/authentication/plugins/auth_ldap.py @@ -195,7 +195,7 @@ class AuthLdap(object): def __init__(self, server, base_dn, port=389, bind_dn='', bind_pass='', tls_kind='PLAIN', tls_reqcert='DEMAND', ldap_version=3, search_scope='SUBTREE', attr_login='uid', - ldap_filter=None): + ldap_filter=''): if ldap == Missing: raise LdapImportError("Missing or incompatible ldap library") From d8233cfebee510c3ec5e8b563c815c7bf9379e8f Mon Sep 17 00:00:00 2001 From: Marcin Lulek Date: Wed, 8 Nov 2017 23:58:56 +0100 Subject: [PATCH 3/9] security: fix self xss on repo downloads picker for svn case. --- rhodecode/templates/summary/summary.mako | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/rhodecode/templates/summary/summary.mako b/rhodecode/templates/summary/summary.mako index 1cf50473..ffba157e 100644 --- a/rhodecode/templates/summary/summary.mako +++ b/rhodecode/templates/summary/summary.mako @@ -102,11 +102,12 @@ $(document).ready(function(){ // on change of download options $('#download_options').on('change', function(e) { // format of Object {text: "v0.0.3", type: "tag", id: "rev"} + var ext = '.zip'; var selected_cs = e.added; - var fname= e.added.raw_id + ".zip"; + var fname = e.added.raw_id + ext; var href = pyroutes.url('repo_archivefile', {'repo_name': templateContext.repo_name, 'fname':fname}); // set new label - $('#archive_link').html(' '+ e.added.text+".zip"); + $('#archive_link').html(' {0}{1}'.format(escapeHtml(e.added.text), ext)); // set new url to button, $('#archive_link').attr('href', href) From 4b188bf54541acb88c495aa80fe1a44a21b6e5f3 Mon Sep 17 00:00:00 2001 From: Marcin Kuzminski Date: Sat, 11 Nov 2017 10:44:24 +0100 Subject: [PATCH 4/9] pull-requests: loosen permissions on creation of PR. - in fork based workflow we want still users with just read permissions to open a PR againt that repository. --- rhodecode/apps/repository/views/repo_pull_requests.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/rhodecode/apps/repository/views/repo_pull_requests.py b/rhodecode/apps/repository/views/repo_pull_requests.py index ff40c4b5..c1cae8ed 100644 --- a/rhodecode/apps/repository/views/repo_pull_requests.py +++ b/rhodecode/apps/repository/views/repo_pull_requests.py @@ -790,9 +790,10 @@ class RepoPullRequestsView(RepoAppView, DataGridAppView): h.route_path('pullrequest_new', repo_name=self.db_repo_name, _query=org_query)) - # target repo we must have write permissions, and also later on + # target repo we must have read permissions, and also later on # we want to check branch permissions here target_perm = HasRepoPermissionAny( + 'repository.read', 'repository.write', 'repository.admin')(target_db_repo.repo_name) if not target_perm: msg = _('Not Enough permissions to target repo `{}`.'.format( From 9782bb662facaa6bc171e9119feddb4019ead491 Mon Sep 17 00:00:00 2001 From: Marcin Kuzminski Date: Sat, 11 Nov 2017 16:10:36 +0100 Subject: [PATCH 5/9] docs: added release notest for 4.10.3 --- docs/release-notes/release-notes-4.10.3.rst | 45 +++++++++++++++++++++ docs/release-notes/release-notes.rst | 1 + 2 files changed, 46 insertions(+) create mode 100644 docs/release-notes/release-notes-4.10.3.rst diff --git a/docs/release-notes/release-notes-4.10.3.rst b/docs/release-notes/release-notes-4.10.3.rst new file mode 100644 index 00000000..e324520a --- /dev/null +++ b/docs/release-notes/release-notes-4.10.3.rst @@ -0,0 +1,45 @@ +|RCE| 4.10.3 |RNS| +------------------ + +Release Date +^^^^^^^^^^^^ + +- 2017-11-11 + + +New Features +^^^^^^^^^^^^ + + + +General +^^^^^^^ + +- ldap: increase timeouts and timelimits for operations + + +Security +^^^^^^^^ + +- security(low): fix self xss on repo downloads picker for svn case. + + +Performance +^^^^^^^^^^^ + + + +Fixes +^^^^^ + + +- Pull requests: loosen permissions on creation of PR, fixing regression. +- LDAP: fix regression in ldap search filter implementation after upgrade to + newer version of python-ldap library. + + +Upgrade notes +^^^^^^^^^^^^^ + +- Changes helpers to support regression in PR creation and increase + LDAP server timeouts, no potential problems with upgrade. diff --git a/docs/release-notes/release-notes.rst b/docs/release-notes/release-notes.rst index 9b3bcb89..3725f1ae 100644 --- a/docs/release-notes/release-notes.rst +++ b/docs/release-notes/release-notes.rst @@ -9,6 +9,7 @@ Release Notes .. toctree:: :maxdepth: 1 + release-notes-4.10.3.rst release-notes-4.10.2.rst release-notes-4.10.1.rst release-notes-4.10.0.rst From 8aa9dda18f46becfe61eac2f6306841968b73a40 Mon Sep 17 00:00:00 2001 From: Marcin Kuzminski Date: Sat, 11 Nov 2017 18:39:17 +0100 Subject: [PATCH 6/9] release: Start preparation for 4.10.3 --- .bumpversion.cfg | 2 +- .release.cfg | 9 ++------- rhodecode/VERSION | 2 +- 3 files changed, 4 insertions(+), 9 deletions(-) diff --git a/.bumpversion.cfg b/.bumpversion.cfg index ff4e4e24..4deb2c07 100644 --- a/.bumpversion.cfg +++ b/.bumpversion.cfg @@ -1,5 +1,5 @@ [bumpversion] -current_version = 4.10.2 +current_version = 4.10.3 message = release: Bump version {current_version} to {new_version} [bumpversion:file:rhodecode/VERSION] diff --git a/.release.cfg b/.release.cfg index c5467c2e..16b75212 100644 --- a/.release.cfg +++ b/.release.cfg @@ -5,23 +5,18 @@ done = false done = true [task:rc_tools_pinned] -done = true [task:fixes_on_stable] -done = true [task:pip2nix_generated] -done = true [task:changelog_updated] -done = true [task:generate_api_docs] -done = true [release] -state = prepared -version = 4.10.2 +state = in_progress +version = 4.10.3 [task:updated_translation] diff --git a/rhodecode/VERSION b/rhodecode/VERSION index 6f7e03a0..fc2ad41b 100644 --- a/rhodecode/VERSION +++ b/rhodecode/VERSION @@ -1 +1 @@ -4.10.2 \ No newline at end of file +4.10.3 \ No newline at end of file From 2cb66cfacaf15413ddc898c722cbe6137fe663ec Mon Sep 17 00:00:00 2001 From: Marcin Kuzminski Date: Sat, 11 Nov 2017 18:46:56 +0100 Subject: [PATCH 7/9] release: updated pip2nix output for 4.10.3 --- .release.cfg | 4 ++++ pkgs/python-packages.nix | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/.release.cfg b/.release.cfg index 16b75212..d1630718 100644 --- a/.release.cfg +++ b/.release.cfg @@ -5,14 +5,18 @@ done = false done = true [task:rc_tools_pinned] +done = true [task:fixes_on_stable] +done = true [task:pip2nix_generated] [task:changelog_updated] +done = true [task:generate_api_docs] +done = true [release] state = in_progress diff --git a/pkgs/python-packages.nix b/pkgs/python-packages.nix index fbc87729..669284d9 100644 --- a/pkgs/python-packages.nix +++ b/pkgs/python-packages.nix @@ -1719,7 +1719,7 @@ }; }; rhodecode-enterprise-ce = super.buildPythonPackage { - name = "rhodecode-enterprise-ce-4.10.2"; + name = "rhodecode-enterprise-ce-4.10.3"; buildInputs = with self; [pytest py pytest-cov pytest-sugar pytest-runner pytest-catchlog pytest-profiling gprof2dot pytest-timeout mock WebTest cov-core coverage configobj]; doCheck = true; propagatedBuildInputs = with self; [Babel Beaker FormEncode Mako Markdown MarkupSafe MySQL-python Paste PasteDeploy PasteScript Pygments pygments-markdown-lexer Pylons Routes SQLAlchemy Tempita URLObject WebError WebHelpers WebHelpers2 WebOb WebTest Whoosh alembic amqplib anyjson appenlight-client authomatic cssselect celery channelstream colander decorator deform docutils gevent gunicorn infrae.cache ipython iso8601 kombu lxml msgpack-python nbconvert packaging psycopg2 py-gfm pycrypto pycurl pyparsing pyramid pyramid-debugtoolbar pyramid-mako pyramid-beaker pysqlite python-dateutil python-ldap python-memcached python-pam recaptcha-client redis repoze.lru requests simplejson sshpubkeys subprocess32 waitress zope.cachedescriptors dogpile.cache dogpile.core psutil py-bcrypt]; From abcd180bd024f1fafda1cb621f677dd5aea9b90a Mon Sep 17 00:00:00 2001 From: Marcin Kuzminski Date: Sat, 11 Nov 2017 18:46:57 +0100 Subject: [PATCH 8/9] release: Finish preparation for 4.10.3 --- .release.cfg | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.release.cfg b/.release.cfg index d1630718..ad7775b9 100644 --- a/.release.cfg +++ b/.release.cfg @@ -11,6 +11,7 @@ done = true done = true [task:pip2nix_generated] +done = true [task:changelog_updated] done = true @@ -19,7 +20,7 @@ done = true done = true [release] -state = in_progress +state = prepared version = 4.10.3 [task:updated_translation] From 4d9a4b0217b023b58a542d112edc71bbebe2a365 Mon Sep 17 00:00:00 2001 From: Marcin Kuzminski Date: Sat, 11 Nov 2017 18:46:58 +0100 Subject: [PATCH 9/9] Added tag v4.10.3 for changeset 68baee10e698