engineering/unrhodecode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
1818 commits 1 branch 0 tags 110 MiB
Commit graph

1818 commits

This branch
This branch
All branches
Author SHA1 Message Date
Marcin Lulek
cc53162981 security: use 404 instead of 403 code on permission decorator to prevent resource discovery attacks. 2017-06-19 18:15:57 +02:00
Marcin Kuzminski
f442430df8 my-account: moved emails config into pyramid views. 2017-06-19 15:30:09 +02:00
Marcin Lulek
ad54b9a57d security: use new safe escaped user attributes across the application. 
- will fix all possible XSS attack vectors.
 2017-06-19 15:14:02 +02:00
Marcin Lulek
91e65dd798 User: use new escaped hybrid properties for usage in code. 
- Allows introducing the safer method of reading first/last names from users.
 2017-06-19 10:56:31 +02:00
Marcin Kuzminski
aa3bffd198 pull-requests: prepare the migration of pull request to pyramid. 
- this is half the code because of problems found during porting
- partially moved the urls, and flipped the logic into pyramid code
- needs more work in core for full switch.
 2017-06-19 13:25:15 +02:00
Marcin Kuzminski
dabc0de3df notifications: fixed problem with 500 errors on non-numeric 
notification id given.
 2017-06-19 10:10:19 +02:00
Marcin Lulek
0e6fcd4658 security: added missing csrf checks in few missing views. 2017-06-19 09:20:07 +02:00
Marcin Lulek
779587086e security: fixed self-xss inside file views. 2017-06-17 17:06:57 +02:00
Marcin Lulek
ea90ac1210 security: fix self-xss inside repo strip view. 2017-06-17 16:06:06 +02:00
Daniel Dourvaris
1eff40ea89 docs: added example how to secure login page from brute force attacks. 2017-06-15 23:32:01 +02:00
Marcin Kuzminski
926a79e98e audit-logs: implemented pull request and comment events. 2017-06-17 15:22:50 +02:00
Marcin Kuzminski
8a3441e96e audit-logs: use specific web/api calls. 
- also normalized action_data to specs.
 2017-06-14 16:33:23 +02:00
Marcin Kuzminski
8ae7a08fd3 audit-logs: added audit logs on user groups admin page. 2017-06-14 15:25:31 +02:00
Marcin Kuzminski
32d96c3e6a action_logger: removed really not required actions of start/stop following a repository. 
- this information just spams user information, and for product such as rhodecode this
doesn't make any sense to be stored.
 2017-06-14 15:04:03 +02:00
Marcin Kuzminski
1be028f546 audit-logs: moved async tasks from old deprecated action_logger. 2017-06-14 15:45:17 +02:00
Marcin Kuzminski
8ec82f1089 audit-logs: fill in some default values for the expected action data. 2017-06-14 15:46:06 +02:00
Marcin Kuzminski
4bd5c08e87 audit-logs: added audit-logs on user actions. 
- adding/deleting ips
- adding/deleting emails
- edit/create
 2017-06-14 14:38:59 +02:00
Marcin Kuzminski
7618001212 audit-logger: added convinience wrappers to store web or api action. 2017-06-14 14:15:11 +02:00
Marcin Kuzminski
3e76f23368 audit-logs: added action logs for repository groups. 2017-06-14 12:39:51 +02:00
Marcin Kuzminski
dbcc488137 audit-logs: implement enum sources that should be re-used. 2017-06-14 11:51:46 +02:00
Marcin Kuzminski
c36f3f7abd tests: removed soon-to-be deleted test for deprecated action_logger. 2017-06-14 14:39:19 +02:00
Marcin Kuzminski
10162bb050 cleanup: imports cleanup. 2017-06-14 11:23:27 +02:00
Daniel Dourvaris
2beb24a857 reviewers: added validation and default review rules via API calls. 
- update/create pull request now validate and update the default reviewer rules.
 2017-06-14 11:10:19 +02:00
Daniel Dourvaris
930c7eebbd api: attach the call context variables to request for later usage 
in API calls.
 2017-06-14 11:07:54 +02:00
Daniel Dourvaris
091c9d9d99 pull-requests: make sure to skip duplicates of reviewers via PR create method. 2017-06-14 00:15:06 +02:00
Marcin Kuzminski
5915f38fcf pull-request-api: updated logic of closing a PR via API call. 
- consistent logic via web and API
- updated events
- updated proper close checks.
 2017-06-13 00:14:21 +02:00
Marcin Kuzminski
f11a476967 auth: prepare code for removal of pylons request in pyramid migration. 2017-06-09 12:01:44 +02:00
Marcin Kuzminski
1e5838512f auth: use pyramid only redirections. 2017-06-08 22:44:21 +02:00
Marcin Kuzminski
7e11e618ca events: re-organizate events handling. 
- pass in request from event to url functions to skip request lookup
- added some logging
- prepared for pyramid migration
 2017-06-08 21:37:34 +02:00
Marcin Kuzminski
47f9f32ad9 events: expose permalink urls for different set of object. 
- permalink url should provide a non-changeable url that can be used in
external sources with guarantee of beeing always valid.
 2017-06-08 16:11:33 +02:00
Marcin Kuzminski
36f3dd22fb review-rules: extend code to support the forbid commit authors. 2017-06-08 13:39:54 +02:00
Marcin Kuzminski
53d41696e0 pull-requests: expose author in creation view to be consistent with show view. 2017-06-07 14:35:27 +02:00
Marcin Kuzminski
53b4ac98f8 repo-summary: re-implemented summary view as pyramid. 
- changed exception handler, to now work in pure pyramid mode
- changed missing requirements logic on repo based views that require vcs-connection
 2017-06-07 13:23:21 +02:00
Marcin Kuzminski
3d2de9920e docs: updated info about client usage. 2017-06-07 09:26:39 +02:00
Marcin Kuzminski
3ab227d76c navigation: remove # from url in options navigation entry. 
- leaving '#' in url is not good behaviour, and menulink class prevents the click anyway.
 2017-06-06 14:12:49 +02:00
Marcin Kuzminski
fc4694f91f pyramid: removed pylons reference from apps. 
- this can be completly removed from those views as they are pyramid only.
 2017-06-06 13:35:05 +02:00
Marcin Kuzminski
95eeb93a9a security: fixed tests. 2017-06-06 13:34:22 +02:00
Marcin Kuzminski
9757a7c0c3 security: escape always the provided user data like firstname/lastname. 2017-06-06 11:59:46 +02:00
Marcin Kuzminski
dc01a7b739 security: fixed XSS inside the tooltip for author string. 2017-06-06 09:30:12 +02:00
Marcin Kuzminski
18a356ec2a predicates: skip route matching for vcs type calls. 2017-06-05 22:23:30 +02:00
Marcin Kuzminski
50a0a1e75a emails: fixed qualified url in user registration email. 2017-06-05 20:04:28 +02:00
Marcin Kuzminski
6680a287da core: improve attach context attribute to rely strictly on already provided user. 2017-06-05 19:22:27 +02:00
Marcin Kuzminski
6a85677174 auth: re-use the get_current_request in fetching request in decorators. 
- will later help porting to pyramid
 2017-06-05 19:18:37 +02:00
Marcin Kuzminski
71fee00277 home: moved home and repo group views into pyramid. 
- fixed lots of tests related to those changes
- now main and subrepo group views are handled by pyramid.
 2017-06-05 15:16:04 +02:00
Marcin Kuzminski
d47af44f72 nix: update default.nix to be consistent with ordering with vcsserver. 2017-06-05 15:24:11 +02:00
Marcin Kuzminski
587e36d745 auth-plugins: updated description on auth_ldap plugin servers. 2017-06-01 12:46:15 +02:00
Marcin Kuzminski
55120caf0e reviewers: store additional review data. 
G: changed rhodecode/model/db.py
 2017-06-05 17:09:03 +02:00
Marcin Kuzminski
a27df6ef4a features: show new review rules in CE default reviewers 2017-05-30 16:01:56 +02:00
Marcin Kuzminski
bd1e865c9c pull-request: extended default reviewers functionality. 
- added mandatory reviewers JS logic Fixes: #4219
- added option to forbid author to be a reviewer via JS/Frontend checks. Fixes #5190
- added option to forbid adding new reviewers except those defined. Fixes #5208
 2017-05-29 20:10:17 +02:00
Marcin Kuzminski
83187d1dfc user-autocomplete: allow skipping default user. 2017-05-29 09:48:29 +02:00