engineering/unrhodecode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
2163 commits 1 branch 0 tags 110 MiB
Commit graph

194 commits

Author SHA1 Message Date
Marcin Kuzminski
cbcd579b02 svn: allow specifying alternative template file for mod_dav config. 2017-10-10 09:30:22 +02:00
Marcin Kuzminski
c66d2e978e files: prevent XSS in fake errors message on filenodes. 2017-10-09 22:37:05 +02:00
Marcin Lulek
df9121dcf1 auth: don't expose full set of permissions into channelstream payload. 
This leads to resource discovery security vulnerability
 2017-10-08 23:31:45 +02:00
Marcin Kuzminski
abf63a445f audit-logs: expose tailoed audit logs in repository view 2017-10-08 12:11:04 +02:00
Marcin Lulek
b900d908c5 security: fix XSS in repo strip view. 2017-10-07 13:14:08 +02:00
Marcin Kuzminski
fe428ab4d7 files: protect against 500 errors on nodelist. 2017-10-07 10:33:47 +02:00
Marcin Kuzminski
10231cba28 changelog: prevent from 500 errors on changelog when fetching certain commits. 2017-10-07 10:13:39 +02:00
Marcin Kuzminski
eb50f6c575 commits: add protection against 500 errors on commit children/parents page. 2017-10-06 15:44:17 +02:00
Marcin Kuzminski
f175d99411 login: don't use request.params because it allows to passing multiple 
values for GET which can confuse the system.
 2017-10-06 15:19:36 +02:00
Marcin Kuzminski
3fea802084 repo-summary: protect against wrong commits in repo summary. 2017-10-06 15:02:25 +02:00
Marcin Kuzminski
569e2a30ba i18n: fix typo 2017-10-05 11:21:40 +02:00
Marcin Kuzminski
862e0c122b commits: hide evolve commits. Fixes #5392 2017-10-03 16:37:39 +02:00
Marcin Kuzminski
a00cc457a9 ssh-keys: expose last access time on admin summary page for SSH keys. 2017-09-27 22:21:04 +02:00
Marcin Kuzminski
6eac893f8f changelog: fix consistency of returned data to 2 element tuple. 2017-09-27 17:26:07 +02:00
Marcin Kuzminski
3783c23d90 changelog: only load graph data when showing changelog for both commit and commit loaded via ajax chunks. 2017-09-27 13:28:45 +02:00
Marcin Kuzminski
3718a47d3f changelog: fix and optimize loading of chunks for file history. 
- load-next/prev wasn't working
- make sure pagination works as expected
- speed up certain actions by pre-loading more attributes
 2017-09-27 13:21:57 +02:00
Marcin Kuzminski
59ed8f2d47 changelog: fix url generation for file changelog and ensure 
http redirect works as expected for unfound nodes.
 2017-09-25 13:55:31 +02:00
Marcin Kuzminski
a9fc01d079 repo-auth-tokens: UX, set and disable to VCS scope if selected an repo from select2 2017-09-21 20:12:13 +02:00
Marcin Kuzminski
79c8fadc26 repo-data: fixed missing parameter we used to propagate JS with. 
- was breaking the repo selectors
 2017-09-21 19:46:27 +02:00
Marcin Kuzminski
b505377197 users: ported controllers from pylons into pyramid views. 2017-09-20 22:29:34 +02:00
Marcin Kuzminski
37ef509c3f tests: fixed some more test issues during stress tests runs. 2017-09-21 11:52:32 +02:00
Marcin Kuzminski
a8d0784226 tests: fixed tests for random dict order could sometimes break the tests 2017-09-20 23:33:29 +02:00
Marcin Kuzminski
b95e835ebb audit-logs: allow showing individual entries for audit log. 2017-09-21 16:47:10 +02:00
Marcin Kuzminski
cb071ab951 user-groups: use request partial renderer and not the pylons one. 2017-09-20 20:18:53 +02:00
Marcin Kuzminski
bcac21cb46 user-groups-audit: properly register add/delete members on main 
edit screen for user group. ref #5390
 2017-09-20 17:14:55 +02:00
Marcin Kuzminski
2f5d2e7d67 routing: removed more usage of pylons url() objects. 2017-09-20 15:21:03 +02:00
Marcin Kuzminski
4679c5bfcb home: removed old pylons routes and convert them to pyramid ops app 2017-09-19 12:47:18 +02:00
Marcin Kuzminski
cfe326566d helpers: remove usage of pylons session. 2017-09-19 17:11:48 +02:00
Marcin Kuzminski
0fd76867b6 auth-tokens: allow specifing custom expiration date manually. 
- fixes #5323
 2017-09-08 18:03:35 +02:00
Marcin Kuzminski
3821db3f37 apps: removed deprecated usage of c.repo_info 2017-09-08 13:33:17 +02:00
Marcin Kuzminski
87a5eb4bde apps: cleanup imports 2017-09-08 12:56:47 +02:00
Marcin Kuzminski
e8fe72ebfb admin: cleanup imports. 2017-09-08 12:49:41 +02:00
Marcin Kuzminski
7a511201a1 admin-defaults: ported views to pyramid. 2017-09-08 11:48:48 +02:00
Marcin Lulek
a307f2677c feeds: generate entries with proper unique ids. 
- fixes #5379
 2017-09-01 16:05:06 +02:00
Marcin Kuzminski
a8abeb0d1c user-groups: rewrote the app to pyramid 
- added new event data with added/removed/changed permissions
- cleanup code and spelling
 2017-08-31 12:47:19 +02:00
Marcin Kuzminski
ee20d401c8 users: changed spelling of users_groups to user_groups. Because English :] 2017-08-29 15:46:26 +02:00
Marcin Kuzminski
ebbfb35adf user-group: perms summary, fix view name. 2017-08-25 10:11:32 +02:00
Marcin Kuzminski
57031945a3 pull-requests: use merge info to show how Pull requests will be merged. 
- rebase or merge commit is shown as merge strategy.
- close/delete branch are shown if that option is selected.
 2017-08-23 13:48:10 +02:00
Marcin Kuzminski
c7704859cf pull-requests: in case of an error redirect to the same url as source. 
- will keep the bookmark/branch info, and help re-select proper revisions.
 2017-08-23 12:31:38 +02:00
Marcin Kuzminski
5a490b42a4 pull-requests: redirect to repo PR after delete instead of my account. 2017-08-22 22:29:38 +02:00
Marcin Kuzminski
34a59d2066 compare: make sure to not do any redirects for XHR requests types. 
This can lead to page-in-page rendering when using ajax compare loading.
 2017-08-23 13:02:37 +02:00
Marcin Kuzminski
890cb7ef61 search: per-repo search shouldn't require admin permissions. Read is enought because we access the repo only 2017-08-21 19:30:27 +02:00
Marcin Kuzminski
7c571b29bc ssh: fixed tests for disabled ssh support 2017-08-20 20:48:10 +02:00
Marcin Kuzminski
ededb0c7ff SSH: disable visually support ssh keys if we have them disabled in the .ini 2017-08-20 12:23:47 +02:00
Marcin Kuzminski
b7c17b192d ssh: added ssh key management into my account. 2017-08-19 17:47:01 +02:00
Marcin Kuzminski
034abca8dc ssh: embedded ssh support 
- updated command generation and added debug flag
- updated .ini config to have ALL required components to run SSH commands
- rcssh-wrapper now is embedded and pinned into version of enterprise
- update ssh_support configration
- implements #5343
 2017-08-18 14:32:00 +02:00
Marcin Kuzminski
3ea8958a92 ssh-keys: added admin panel for managing globally all SSH Keys. 
- added also option to manually update the keyfile
- fetch and show all user keys for audit purpose
 2017-08-17 22:46:26 +02:00
Marcin Kuzminski
429c3a56cb data-grid-app: added universal function for extracting ordering. 
- now supports format a.b
- supports passing a ref column e.g User.username, get's handy for joined querie
 2017-08-17 22:44:25 +02:00
Marcin Kuzminski
aca661a15e goto-switcher: optimized performance and query capabilities. 
- Previous implementation had on significant bug. The use of LIMIT 20
was limiting results BEFORE auth checks. In case of large ammount of similarly
named repositories user didn't had access too, the result goto search was empty.

This was becuase first 20 items fetched didn't pass permission checks and final
auth list was empty.

To fix this we now use proper filtering for auth using SQL. It means we first check
user allowed repositories, and add this as a filter so end result from database is already
to only the accessible repositories.
 2017-08-16 22:46:34 +02:00
Marcin Kuzminski
e8ec2b950f goto-switcher: use special commit: prefix to explicitly search for commits. 
- previous solution could make the go-to swticher slow in case of huge search index
- mixing repository names and commit names could lead to bad UX when searching
- explicit case still allows this, but user is in the control how and what he wants to search
- fixes #5375
 2017-08-15 21:33:01 +02:00