engineering/unrhodecode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
2163 commits 1 branch 0 tags 110 MiB
Commit graph

46 commits

Author SHA1 Message Date
Marcin Lulek
df9121dcf1 auth: don't expose full set of permissions into channelstream payload. 
This leads to resource discovery security vulnerability
 2017-10-08 23:31:45 +02:00
Marcin Kuzminski
b505377197 users: ported controllers from pylons into pyramid views. 2017-09-20 22:29:34 +02:00
Marcin Kuzminski
b8a108e1d4 sessions: don't use pylons sessions for csrf tokens 2017-09-19 23:29:03 +02:00
Marcin Kuzminski
4e50794cfb auth: use consistent way of extracting came_from, and also sanitise it to remove 
auth_token. This prevents a loop of redirection in case we get redirected to login
with this parameter.
 2017-09-06 23:39:45 +02:00
Marcin Kuzminski
a8abeb0d1c user-groups: rewrote the app to pyramid 
- added new event data with added/removed/changed permissions
- cleanup code and spelling
 2017-08-31 12:47:19 +02:00
Marcin Kuzminski
48959fcd73 auth: don't double register the permission in case no inheritance is turned on 2017-08-28 12:56:04 +02:00
Marcin Kuzminski
c0899ff09d auth: expose a option to calculate how we end up having super-admin permission. 
This is now used only for visual display. The old way is still faster for permissions
calculation.

- the extended way will be used in permission summary showing a much more detailed
permission summary for super-admins.
 2017-08-27 19:30:42 +02:00
Marcin Kuzminski
54ad0eaea2 auth: use pesistent naming of keys in auth. Refactoring only. 2017-08-27 19:29:10 +02:00
Marcin Kuzminski
868ab0ed73 permissions: explicitly register all permissions set for user. Fixes #4217 
- in order to get a proper inheritance chain of permissions we'll register each step.
This allows to get full inheritance chain. Final permissions will be the same becuase
the only thing we change is we register each step before permissions final value.
- Also display the permissions summary in a nicer way more explicitly stating what
permissions overwrites which.
 2017-08-25 17:43:28 +02:00
Marcin Kuzminski
dcedd44327 auth: added additional name filters to the acl helpers. 
- helps narrowing the results based on if we use a search param or not.
 2017-08-16 21:51:10 +02:00
Marcin Kuzminski
f539d88365 auth: added helpers to fetch IDs of repos/repo groups/user groups that 
user have access to.

- this can be used to do filtering by IDs and do SQL based ACLs
 2017-08-16 14:05:36 +02:00
Marcin Kuzminski
905e6ea6e0 auth: XHRRequired decorator is no longer required. 
- was replaced by xhr=True view config of pyramid
 2017-08-03 21:39:48 +02:00
Marcin Kuzminski
d86be7d432 auth_white_list: translate from old style controllers to the new views. 2017-08-03 18:40:48 +02:00
Marcin Kuzminski
bb544cbad6 auth: allow binding the whitelist views to specific tokens 2017-08-03 18:54:52 +02:00
Marcin Kuzminski
2c11516c9b routing: optionally use explicit db object on route. 
- makes it harder to integrate plugins
- makes it consistent on other places
- allows some plugins to use just the names
 2017-08-01 22:59:15 +02:00
Marcin Kuzminski
05386904e7 forks: moved pylons code into pyramid. 2017-08-01 11:48:16 +02:00
Marcin Kuzminski
0c1f7e3306 auth: improve logging 2017-07-25 15:07:43 +02:00
Marcin Kuzminski
3f26df9f37 user: deprecated usage of api_keys. 
- additionally we don't load secrets as they are never used (and are expensive to fetch)
- simplify fetching of details improves performance
 2017-07-25 16:27:08 +02:00
Marcin Kuzminski
8efc4d92c5 repo-commits: ported changeset code into pyramid views. 
- refactored part of naming to use commit_id instead of revision
- renamed some parts to repo_commits instead of changeset without breaking backward compat
- small improvements and fixes for tests
 2017-07-24 17:04:14 +02:00
Marcin Kuzminski
4a9be66cd1 dependencies: bumped pyramid-debugtoolbar to 4.3.1 2017-07-12 22:55:39 +02:00
Marcin Kuzminski
71071c0b26 dependencies: bumped pyramid to 1.9 webob to 1.7.3 and webtest to 2.0.27 
- fixed some core tests for new webob/webtest
- changed core methods to make them more pyramid compat.
 2017-07-12 22:54:14 +02:00
Marcin Lulek
cc53162981 security: use 404 instead of 403 code on permission decorator to prevent resource discovery attacks. 2017-06-19 18:15:57 +02:00
Marcin Lulek
ad54b9a57d security: use new safe escaped user attributes across the application. 
- will fix all possible XSS attack vectors.
 2017-06-19 15:14:02 +02:00
Marcin Kuzminski
f11a476967 auth: prepare code for removal of pylons request in pyramid migration. 2017-06-09 12:01:44 +02:00
Marcin Kuzminski
1e5838512f auth: use pyramid only redirections. 2017-06-08 22:44:21 +02:00
Marcin Kuzminski
53b4ac98f8 repo-summary: re-implemented summary view as pyramid. 
- changed exception handler, to now work in pure pyramid mode
- changed missing requirements logic on repo based views that require vcs-connection
 2017-06-07 13:23:21 +02:00
Marcin Kuzminski
6a85677174 auth: re-use the get_current_request in fetching request in decorators. 
- will later help porting to pyramid
 2017-06-05 19:18:37 +02:00
Marcin Kuzminski
71fee00277 home: moved home and repo group views into pyramid. 
- fixed lots of tests related to those changes
- now main and subrepo group views are handled by pyramid.
 2017-06-05 15:16:04 +02:00
Marcin Kuzminski
1f812d6a5e caches: ensure we don't use non-ascii characters in cache keys. 
- this could before lead to problems in beaker cache implementation.
 2017-05-15 22:10:36 +02:00
Marcin Kuzminski
7ab84fa130 auth: the correct prefixes for python bcrypt are $2a or $2b. 
handle the 2b too for consistency.
 2017-04-12 20:53:28 +02:00
Marcin Kuzminski
cfa10105b7 core: properly handle new redirections set in decorators. 
- Allows easier full pyramid migration
 2017-03-02 16:10:47 +01:00
Marcin Kuzminski
e2b0f5b7cc auth: make the perms decorators and function pyramid compatible. 2017-02-28 22:21:24 +01:00
Marcin Kuzminski
ab24af89d2 auth-tokens: disable authenticating by builtin token. 2017-02-27 11:45:30 +01:00
Marcin Kuzminski
023b9f2cf2 auth: make owner of user group give proper admin permissions to the user group. 
This makes the behaviour consisten with repositories and repository groups.
 2017-02-15 11:44:36 +01:00
Marcin Kuzminski
5c2c266ee9 auth-tokens: updated logic of authentication to a common shared user method. 2017-02-13 14:36:48 +01:00
Marcin Kuzminski
4e8c6733a7 auth: use pyramid HTTP excetion when detecting CSRF error. It helps catching this 
error by our error handler and displaying it nicely to users.
 2017-01-12 23:17:19 +01:00
Marcin Kuzminski
64b98245ef code: added more logging, and some notes 2017-01-12 12:54:21 +01:00
Marcin Kuzminski
6d2a154667 auth: improve logging for auth methods. 2017-01-12 12:07:11 +01:00
Marcin Kuzminski
fcc027c282 license: updated copyright year to 2017 2017-01-02 09:30:39 +01:00
Marcin Kuzminski
9e6713219c repo-groups: implemented default personal repo groups logic. 
- fixes #4003
- adds new settings to automatically create personal repo groups for users on API cal, add user form, registration
- it's possible to create a pattern based repo group for example /u/{username}
 2016-11-07 15:27:36 +01:00
Daniel Dourvaris
b51406ec1d account: convert change password form to colander schema and fix bug 
where user could use same password as before when changing
password, fixes #2264
 2016-08-05 06:55:35 +03:00
Daniel Dourvaris
be2bf30c95 permissions: show overridden permissions in permission summary page 2016-06-06 05:58:37 +03:00
Marcin Kuzminski
c0b1b33fac logging: improve logging on failed auth user lookup 2016-06-03 01:12:17 +02:00
Johannes Bornhold
7beea8e959 auth: Change login url generation in auth decorators. 
Use pyramid to generate login URLs.
 2016-05-25 10:44:26 +02:00
Johannes Bornhold
b8e6e94bb4 auth: Add a method to check if an AuthUser is the default user. 2016-05-24 15:38:43 +02:00
Marcin Kuzminski
9a0d8c0b77 project: added all source files and assets 2016-05-24 15:56:53 +02:00