engineering/unrhodecode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
3273 commits 1 branch 0 tags 110 MiB
Commit graph

69 commits

Author SHA1 Message Date
Daniel Dourvaris
d299f7f7b4 branch permissions: fixed a case of showing branch permissions entries when inheritation model is used. 
- the algo picker used not-explicit pattern but whole set
- fixes #5502
 2018-10-25 11:28:00 +02:00
Marcin Kuzminski
2910f510dc repositories: added option to archive repositories instead of deleting them. 
- closes #5493
 2018-09-25 17:28:11 +02:00
Marcin Kuzminski
9033601562 logging: use lazy parameter evaluation in log calls. 2018-09-13 17:41:35 +02:00
Marcin Kuzminski
08d3f6b83b branch-permissions: enabled branch permissions checks for SSH backend. 2018-08-29 16:41:52 +02:00
Marcin Kuzminski
d3afc86451 branch-permissions: handle vcs operations and branch permissions. 
- use new exceptions for branch permissions
- detect if we need to check permissions
- calculate super-admin the same way as regular users for override capabilities
- added new tests for branch permissions
 2018-08-29 20:22:43 +02:00
Marcin Kuzminski
e41725c078 branch permissions: added logic to define in UI branch permissions. 
- db models
- new permissions pages placeholders
 2018-08-28 13:41:30 +02:00
Marcin Kuzminski
d6757c3989 core: removed last activity as it was creating lots of DB locks. 2018-07-26 21:54:44 +02:00
Marcin Kuzminski
9665179aa5 caches: use new decorator that uses conditional caches skipping dogpile if cache is disabled. 2018-07-14 18:17:42 +02:00
Marcin Kuzminski
ddc445856e caches: rewrite of auth/permission caches to dogpile. 2018-07-05 20:14:33 +02:00
Marcin Kuzminski
564c09e772 ip-restritions: fix issue with loading empty IP rules for non-logged not-anonymous users. 
This case won't have any IP rules set. And we accidentally loaded them becuase of no empty user filter
was present. This caused some odd display warnings for users.
 2018-07-04 12:19:08 +02:00
Marcin Kuzminski
f62a1b94f7 tests: don't use md5 for testing crypto for compliance reasons. 2018-07-03 14:30:57 +02:00
Marcin Kuzminski
06ef71e55a auth: code style, more python3 compat changes. 2018-06-27 17:05:24 +02:00
Marcin Kuzminski
e9d1e470b6 auth: code cleanup, use set literals for py3 compat 2018-06-27 17:26:15 +02:00
Marcin Kuzminski
eb7e9c6ce1 logging: updated logging information on IP checks. 2018-06-27 16:54:58 +02:00
Marcin Kuzminski
e32681449c caches: switch other permission cache to use same cache region. 2018-06-22 18:35:41 +02:00
Marcin Kuzminski
2044170b28 caches: use different namespaces for conditional_cache wrapper. 
Before we used one namespace for ALL meaning caches were kept in single file, or single DB row.
While this makes sense for single functions, a per-user, per-group cache should be divided to single files.
 2018-06-22 17:31:48 +02:00
Marcin Kuzminski
9c384313d1 auth: update logging for permission calculation function 2018-06-22 13:34:58 +02:00
Marcin Kuzminski
e0b621ed56 permissions: enable caching by controlling short_term cache settings. 2018-06-15 19:36:19 +02:00
Marcin Kuzminski
00b45c1fa7 release: update copyright year to 2018 2018-01-19 17:13:16 +01:00
Marcin Kuzminski
f9f80e3ff9 feed-token, user, performance: lazy load the feed_token. We only need it for 
scope of web requests. For vcs operations, we don't need it.

- 20ms to load this can save up much time for SVN requests.
 2017-12-04 12:14:01 +01:00
Marcin Kuzminski
5f9ae2ae11 pylons: remove pylons as dependency 
- dependencies: bumped:
 -setuptools-scm==1.15.6
 -celery==4.1.0
 -kombu==4.1.0
 -pytz==2017.3
 -Routes==2.4.1

Removed all pylons components. Refactored the code to use only pyramid
parts
 2017-11-15 13:42:54 +01:00
Marcin Kuzminski
f87eee826e auth: remove pylons i18n and replaced it with pyramid translation 2017-11-13 00:09:01 +01:00
Marcin Kuzminski
10cad89493 auth: don't break hashing in case of user with empty password. 
In some cases such as LDAP user created via external scripts users might
set the passwords to empty. The hashing uses the md5(password_hash) to
store reference to detect password changes and forbid using the same password.

In case of pure LDAP users this is not valid, and we shouldn't raise Errors in such
case. This change makes it work for empty passwords now.
 2017-10-27 16:29:46 +02:00
Marcin Lulek
df9121dcf1 auth: don't expose full set of permissions into channelstream payload. 
This leads to resource discovery security vulnerability
 2017-10-08 23:31:45 +02:00
Marcin Kuzminski
b505377197 users: ported controllers from pylons into pyramid views. 2017-09-20 22:29:34 +02:00
Marcin Kuzminski
b8a108e1d4 sessions: don't use pylons sessions for csrf tokens 2017-09-19 23:29:03 +02:00
Marcin Kuzminski
4e50794cfb auth: use consistent way of extracting came_from, and also sanitise it to remove 
auth_token. This prevents a loop of redirection in case we get redirected to login
with this parameter.
 2017-09-06 23:39:45 +02:00
Marcin Kuzminski
a8abeb0d1c user-groups: rewrote the app to pyramid 
- added new event data with added/removed/changed permissions
- cleanup code and spelling
 2017-08-31 12:47:19 +02:00
Marcin Kuzminski
48959fcd73 auth: don't double register the permission in case no inheritance is turned on 2017-08-28 12:56:04 +02:00
Marcin Kuzminski
c0899ff09d auth: expose a option to calculate how we end up having super-admin permission. 
This is now used only for visual display. The old way is still faster for permissions
calculation.

- the extended way will be used in permission summary showing a much more detailed
permission summary for super-admins.
 2017-08-27 19:30:42 +02:00
Marcin Kuzminski
54ad0eaea2 auth: use pesistent naming of keys in auth. Refactoring only. 2017-08-27 19:29:10 +02:00
Marcin Kuzminski
868ab0ed73 permissions: explicitly register all permissions set for user. Fixes #4217 
- in order to get a proper inheritance chain of permissions we'll register each step.
This allows to get full inheritance chain. Final permissions will be the same becuase
the only thing we change is we register each step before permissions final value.
- Also display the permissions summary in a nicer way more explicitly stating what
permissions overwrites which.
 2017-08-25 17:43:28 +02:00
Marcin Kuzminski
dcedd44327 auth: added additional name filters to the acl helpers. 
- helps narrowing the results based on if we use a search param or not.
 2017-08-16 21:51:10 +02:00
Marcin Kuzminski
f539d88365 auth: added helpers to fetch IDs of repos/repo groups/user groups that 
user have access to.

- this can be used to do filtering by IDs and do SQL based ACLs
 2017-08-16 14:05:36 +02:00
Marcin Kuzminski
905e6ea6e0 auth: XHRRequired decorator is no longer required. 
- was replaced by xhr=True view config of pyramid
 2017-08-03 21:39:48 +02:00
Marcin Kuzminski
d86be7d432 auth_white_list: translate from old style controllers to the new views. 2017-08-03 18:40:48 +02:00
Marcin Kuzminski
bb544cbad6 auth: allow binding the whitelist views to specific tokens 2017-08-03 18:54:52 +02:00
Marcin Kuzminski
2c11516c9b routing: optionally use explicit db object on route. 
- makes it harder to integrate plugins
- makes it consistent on other places
- allows some plugins to use just the names
 2017-08-01 22:59:15 +02:00
Marcin Kuzminski
05386904e7 forks: moved pylons code into pyramid. 2017-08-01 11:48:16 +02:00
Marcin Kuzminski
0c1f7e3306 auth: improve logging 2017-07-25 15:07:43 +02:00
Marcin Kuzminski
3f26df9f37 user: deprecated usage of api_keys. 
- additionally we don't load secrets as they are never used (and are expensive to fetch)
- simplify fetching of details improves performance
 2017-07-25 16:27:08 +02:00
Marcin Kuzminski
8efc4d92c5 repo-commits: ported changeset code into pyramid views. 
- refactored part of naming to use commit_id instead of revision
- renamed some parts to repo_commits instead of changeset without breaking backward compat
- small improvements and fixes for tests
 2017-07-24 17:04:14 +02:00
Marcin Kuzminski
4a9be66cd1 dependencies: bumped pyramid-debugtoolbar to 4.3.1 2017-07-12 22:55:39 +02:00
Marcin Kuzminski
71071c0b26 dependencies: bumped pyramid to 1.9 webob to 1.7.3 and webtest to 2.0.27 
- fixed some core tests for new webob/webtest
- changed core methods to make them more pyramid compat.
 2017-07-12 22:54:14 +02:00
Marcin Lulek
cc53162981 security: use 404 instead of 403 code on permission decorator to prevent resource discovery attacks. 2017-06-19 18:15:57 +02:00
Marcin Lulek
ad54b9a57d security: use new safe escaped user attributes across the application. 
- will fix all possible XSS attack vectors.
 2017-06-19 15:14:02 +02:00
Marcin Kuzminski
f11a476967 auth: prepare code for removal of pylons request in pyramid migration. 2017-06-09 12:01:44 +02:00
Marcin Kuzminski
1e5838512f auth: use pyramid only redirections. 2017-06-08 22:44:21 +02:00
Marcin Kuzminski
53b4ac98f8 repo-summary: re-implemented summary view as pyramid. 
- changed exception handler, to now work in pure pyramid mode
- changed missing requirements logic on repo based views that require vcs-connection
 2017-06-07 13:23:21 +02:00
Marcin Kuzminski
6a85677174 auth: re-use the get_current_request in fetching request in decorators. 
- will later help porting to pyramid
 2017-06-05 19:18:37 +02:00