engineering/unrhodecode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
1862 commits 1 branch 0 tags 110 MiB
Commit graph

1862 commits

This branch
This branch
All branches
Author SHA1 Message Date
Marcin Kuzminski
ae89e38cf4 release: Start preparation for 4.9.0 2017-08-12 19:55:15 +02:00
Marcin Kuzminski
7347874011 docs: added release notes for 4.9.0 2017-08-12 11:48:49 +02:00
Marcin Kuzminski
0012823054 docs: updated svn configuration to prevent 400 errors on certain Apache versions. 2017-08-12 19:20:06 +02:00
Marcin Kuzminski
ad948b5e46 events: make sure we propagate our dummy request with proper application_url. 
- handles proper proxy prefix
- handles https and reverse proxies
 2017-07-26 16:19:06 +02:00
Marcin Kuzminski
2b91837f9c pyramid: ported pyramid routing for events 2017-08-11 23:54:54 +02:00
Marcin Kuzminski
711278bd27 docs: small rst fixes. 2017-06-29 11:36:13 +02:00
Marcin Kuzminski
3ff7d208b8 Added tag v4.8.0 for changeset 9731914f8976 2017-06-28 22:03:49 +02:00
Marcin Kuzminski
7f12c82a1e release: Finish preparation for 4.8.0 2017-06-28 22:03:47 +02:00
Marcin Kuzminski
053c523bd7 release: updated pip2nix output for 4.8.0 2017-06-28 22:03:26 +02:00
Marcin Kuzminski
a77dc3e328 i18n: Update compiled message objects and js i18n files 2017-06-28 21:57:54 +02:00
Marcin Kuzminski
a6bbaf210c i18n: Pulled translation from Transifex 2017-06-28 21:57:07 +02:00
Marcin Kuzminski
045b9e6aa5 i18n: Updated message catalog template 2017-06-28 21:55:56 +02:00
Marcin Kuzminski
66eefae578 release: Merge default into stable for release preparation 2017-06-28 21:55:11 +02:00
Marcin Kuzminski
3341c88c61 docs: added changelog for 4.8.0 release. 2017-06-27 16:52:35 +02:00
Marcin Kuzminski
44c4d628dd docs: fix for contribution docs. 2017-06-27 23:45:33 +02:00
Marcin Kuzminski
33b557522f i18n: generated new translation files 2017-06-27 17:26:40 +02:00
Marcin Kuzminski
eb83813cc9 dependencies: bumped objgraph to 3.1.0. 2017-06-28 14:01:46 +02:00
Marcin Kuzminski
f53db19687 diffs: simplified the datastructure of fillediff. Hopefully this 
will allow better Garbage Collection.
 2017-06-28 14:03:57 +02:00
Daniel Dourvaris
372c7c267c tooltip: use consistent h.tooltip usage to set tooltips. 2017-06-28 21:02:21 +02:00
Marcin Kuzminski
f123e5af43 manifest: added ee_features directory for images 2017-06-27 21:02:25 +02:00
Marcin Kuzminski
8ed9abe306 docs: updated api documentation 2017-06-27 17:19:54 +02:00
Marcin Kuzminski
002332dbc2 markup-renderer: use safe fetching of attributes to prevent from errors on malformed html. 2017-06-27 15:44:49 +02:00
Marcin Kuzminski
2500061c51 auth-token: only delete token if it exists. 2017-06-26 13:55:07 +02:00
Marcin Lulek
cb6d81f435 security: escape flash messaged VCS errors to prevent XSS atacks. 2017-06-26 14:48:15 +02:00
Marcin Kuzminski
5fc0ee97f9 docs: added CI integration docs. 2017-06-23 15:06:31 +02:00
Marcin Kuzminski
fb20d49bf1 docs: updated repo extra fields documentation. 2017-06-23 15:06:22 +02:00
Marcin Kuzminski
710d7ad0b5 docs: updated webhook documentation. 2017-06-23 15:06:05 +02:00
Marcin Kuzminski
ccf69ffec7 audit-logs: don't use old style parser for new audit logs. 2017-06-23 12:22:39 +02:00
Marcin Kuzminski
c315ee8d30 security: use custom writer for RST rendering to prevent injection of javascript: tags. 2017-06-23 11:45:51 +02:00
Marcin Kuzminski
9c7ed2caf3 user-api: use simple schema validator to be consistent how we validate between API and web views. 2017-06-21 15:36:24 +02:00
Marcin Kuzminski
749f784ad9 user-group-api: use simple schema validator to be consistent how we validate 
user group names during creation between API and WEB.
 2017-06-21 13:28:12 +02:00
Marcin Lulek
af07c911dc security: use safe escaped version of description for repo and repo group to potentially 
prevent any XSS attacks on returned data.
 2017-06-21 12:23:46 +02:00
Marcin Kuzminski
25436a7365 audit-logs: implemented full audit logs across application. 
- Fixes #5321
- Api+web actions
- To be extended while we develop new features.
 2017-06-21 12:03:14 +02:00
Marcin Lulek
a9ea42785b security: fix self-xss inside the email add functionality. 2017-06-20 20:59:58 +02:00
Marcin Lulek
3aa700c435 security: escape the returned paths of files and directories. 
Nodes function is used for autocomplete in files view, it prevents from
XSS type of attack in file search.
 2017-06-20 20:02:24 +02:00
Marcin Lulek
ffb80aaa1a security: use 404 instead of 403 in case missing permissions for comment deletion. 
- prevents resource discovery
 2017-06-20 19:39:19 +02:00
Marcin Lulek
60285c8c7f security: don't use literal in notifications. 
- exposes security problems
- we don't store any html anyway in the subject
 2017-06-20 19:09:02 +02:00
Marcin Kuzminski
5c99ddb207 audit-logs: added *basic* support for NOT query term in audit logs. 2017-06-20 16:35:40 +02:00
Marcin Kuzminski
d00d73858a audit-logs: updated action data attrbiutes. 2017-06-20 16:35:14 +02:00
Marcin Kuzminski
e5ba163e0c audit-logs: consistent data between my-account and admin user logs. 2017-06-20 16:06:36 +02:00
Marcin Kuzminski
effa0f53ce users-admin: moved views into pyramid for editing emails and ips. 
- added audit-logging
- added few additional tests
 2017-06-20 13:53:44 +02:00
Marcin Kuzminski
37c0465603 my-account: use audit logs for email and token actions. 2017-06-20 13:23:15 +02:00
Marcin Kuzminski
214e9059ec my-account: moved few my account views into pyramid. 2017-06-20 00:11:36 +02:00
Marcin Lulek
e919908333 security: make sure the admin of repo can only delete comments which are from the same repo. 
- fixes IDOR issue
- protects against other people comment deletion by repo admins.
 2017-06-19 21:15:37 +02:00
Marcin Lulek
cc53162981 security: use 404 instead of 403 code on permission decorator to prevent resource discovery attacks. 2017-06-19 18:15:57 +02:00
Marcin Kuzminski
f442430df8 my-account: moved emails config into pyramid views. 2017-06-19 15:30:09 +02:00
Marcin Lulek
ad54b9a57d security: use new safe escaped user attributes across the application. 
- will fix all possible XSS attack vectors.
 2017-06-19 15:14:02 +02:00
Marcin Lulek
91e65dd798 User: use new escaped hybrid properties for usage in code. 
- Allows introducing the safer method of reading first/last names from users.
 2017-06-19 10:56:31 +02:00
Marcin Kuzminski
aa3bffd198 pull-requests: prepare the migration of pull request to pyramid. 
- this is half the code because of problems found during porting
- partially moved the urls, and flipped the logic into pyramid code
- needs more work in core for full switch.
 2017-06-19 13:25:15 +02:00
Marcin Kuzminski
dabc0de3df notifications: fixed problem with 500 errors on non-numeric 
notification id given.
 2017-06-19 10:10:19 +02:00