engineering/unrhodecode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
2163 commits 1 branch 0 tags 110 MiB
Commit graph

2163 commits

This branch
This branch
All branches
Author SHA1 Message Date
Marcin Kuzminski
0baf293f82 files: remove rigth-to-left override character for display in files. 
This allows faking the name a bit, we in this particular place want to
skip the override for enhanced security.
 2017-10-10 10:46:54 +02:00
Marcin Kuzminski
cbcd579b02 svn: allow specifying alternative template file for mod_dav config. 2017-10-10 09:30:22 +02:00
Marcin Kuzminski
c66d2e978e files: prevent XSS in fake errors message on filenodes. 2017-10-09 22:37:05 +02:00
Marcin Kuzminski
7b0f075487 docs: added example how to make tmpfs changes permanent 2017-10-09 11:32:43 +02:00
Marcin Kuzminski
698358646e dependencies: added redis library to enable usage of redis backend for beaker. 2017-10-09 11:43:36 +02:00
Marcin Lulek
df9121dcf1 auth: don't expose full set of permissions into channelstream payload. 
This leads to resource discovery security vulnerability
 2017-10-08 23:31:45 +02:00
Marcin Kuzminski
abf63a445f audit-logs: expose tailoed audit logs in repository view 2017-10-08 12:11:04 +02:00
Marcin Lulek
b900d908c5 security: fix XSS in repo strip view. 2017-10-07 13:14:08 +02:00
Marcin Kuzminski
7781eabe94 auth: use cache_ttl from a plugin to also cache permissions. 
- this gives a 30% speed increase in operations like svn commit
- generally uses the same mechanismy like auth cache to cache permissions for faster
access to vcs commands
 2017-10-07 10:02:39 +02:00
Marcin Kuzminski
34175fd787 auth-rhodecode: don't fail on bcrypt if user password is set to None. 
Default to emptry string to not cause an exception.
 2017-10-07 10:02:57 +02:00
Marcin Kuzminski
fe428ab4d7 files: protect against 500 errors on nodelist. 2017-10-07 10:33:47 +02:00
Marcin Kuzminski
10231cba28 changelog: prevent from 500 errors on changelog when fetching certain commits. 2017-10-07 10:13:39 +02:00
Marcin Kuzminski
eb50f6c575 commits: add protection against 500 errors on commit children/parents page. 2017-10-06 15:44:17 +02:00
Marcin Kuzminski
f175d99411 login: don't use request.params because it allows to passing multiple 
values for GET which can confuse the system.
 2017-10-06 15:19:36 +02:00
Marcin Kuzminski
3fea802084 repo-summary: protect against wrong commits in repo summary. 2017-10-06 15:02:25 +02:00
Marcin Kuzminski
569e2a30ba i18n: fix typo 2017-10-05 11:21:40 +02:00
Marcin Kuzminski
758d34b966 docs: added gzip into static files for nginx 2017-10-05 09:23:33 +02:00
Marcin Kuzminski
724f376e7f docs: added 502 page instructions for nginx and apache 2017-10-04 13:11:04 +02:00
Marcin Kuzminski
862e0c122b commits: hide evolve commits. Fixes #5392 2017-10-03 16:37:39 +02:00
Marcin Kuzminski
bab4242396 user-groups: fix potential problem with group sync of external plugins. 
- when using external plugin we used to check for a parameter that set the
sync mode. The problem is we only checked if the flag was there. So
toggling sync on and off set the value and then left the key still set
but with None. This confused the sync and thought the group should be
synced !
 2017-09-29 21:40:06 +02:00
Marcin Kuzminski
78dae50c63 auth: add more login when performing sync of user groups. 2017-09-29 21:36:23 +02:00
Marcin Kuzminski
cf61eeac12 user sessions: get ability to count memcached sessions 2017-09-29 12:59:44 +02:00
Marcin Kuzminski
f445addfdd vcs: reduce sql queries used during pull/push operations. 2017-09-28 21:45:19 +02:00
Marcin Kuzminski
84564f6aba tests: make the routing link tests retry connections. Reduced test failures 2017-09-28 19:35:58 +02:00
Marcin Kuzminski
4718f3cec9 integrations: expose EE integrations as dummy objects to show 
what EE edition have.
 2017-09-28 18:04:53 +02:00
Marcin Kuzminski
d35f866e04 webhook: add possibility to specify username and password during a call. 2017-09-28 18:22:57 +02:00
Marcin Kuzminski
929184f386 webhook: improve spelling and help text. 2017-09-28 14:24:43 +02:00
Marcin Kuzminski
5fc9f7567b hooks: added debug logs. 2017-09-28 22:14:43 +02:00
Marcin Kuzminski
a00cc457a9 ssh-keys: expose last access time on admin summary page for SSH keys. 2017-09-27 22:21:04 +02:00
Marcin Kuzminski
0342b09c66 dependencies: bumped supervisor to 3.3.3. 
- keep version consistent with rhodecode control
 2017-09-27 22:20:04 +02:00
Marcin Kuzminski
6eac893f8f changelog: fix consistency of returned data to 2 element tuple. 2017-09-27 17:26:07 +02:00
Marcin Kuzminski
3783c23d90 changelog: only load graph data when showing changelog for both commit and commit loaded via ajax chunks. 2017-09-27 13:28:45 +02:00
Marcin Kuzminski
3718a47d3f changelog: fix and optimize loading of chunks for file history. 
- load-next/prev wasn't working
- make sure pagination works as expected
- speed up certain actions by pre-loading more attributes
 2017-09-27 13:21:57 +02:00
Marcin Kuzminski
441639db30 style: optimized <code> element fonts. 2017-09-27 12:14:05 +02:00
Marcin Lulek
725145927b security: limit the maximum password lenght to 72 characters to prevent possible 
server side resource consumption attack.

- bcrypt heavy computation can lead to DOS using a very long password .eg 10**8 lenght.
- we allowed this on registration or on password update
 2017-09-27 10:52:17 +02:00
Marcin Kuzminski
d33953ef3c codemirror: added simple mode plugin required for certain code modes. 2017-09-26 13:06:40 +02:00
Marcin Kuzminski
4291c5fccd gists: add copy url to clipboard helper icon. 2017-09-26 12:47:13 +02:00
Marcin Kuzminski
0459d08860 config: updated .ini files. 2017-09-25 19:33:16 +02:00
Marcin Kuzminski
59ed8f2d47 changelog: fix url generation for file changelog and ensure 
http redirect works as expected for unfound nodes.
 2017-09-25 13:55:31 +02:00
Marcin Kuzminski
897b877309 js: organized and updated JS packages. 
- moved certain embeded files to be tracked via node2nix
- bumped few libraries, jquery to 1.11.3
- bumped moustetrap to 1.6.1
 2017-09-25 13:25:08 +02:00
Marcin Kuzminski
09c537c0fd white-list-access: improved UI. 2017-09-22 00:23:19 +02:00
Marcin Kuzminski
2d3616b0c4 gists: allow copy content to clipboard 2017-09-22 00:04:31 +02:00
Marcin Kuzminski
2a06b6b96d diffs: show copy-to-clipboard next to diff files 2017-09-21 23:29:44 +02:00
Marcin Kuzminski
e6fffe4b97 binaries: cleanup new upcomming rc-* commands that will replace paster * commands from pylons 2017-09-21 21:45:01 +02:00
Marcin Kuzminski
a9fc01d079 repo-auth-tokens: UX, set and disable to VCS scope if selected an repo from select2 2017-09-21 20:12:13 +02:00
Marcin Kuzminski
79c8fadc26 repo-data: fixed missing parameter we used to propagate JS with. 
- was breaking the repo selectors
 2017-09-21 19:46:27 +02:00
Marcin Kuzminski
3332793d91 error-page: use custom causes for 500+ errors 2017-09-21 17:09:53 +02:00
Marcin Kuzminski
53a7edb58c auth: because we use 404 for access denied too. Show proper message about it in error page 2017-09-21 17:04:15 +02:00
Marcin Kuzminski
b505377197 users: ported controllers from pylons into pyramid views. 2017-09-20 22:29:34 +02:00
Marcin Kuzminski
37ef509c3f tests: fixed some more test issues during stress tests runs. 2017-09-21 11:52:32 +02:00