engineering/unrhodecode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
2209 commits 1 branch 0 tags 110 MiB
Commit graph

2209 commits

This branch
This branch
All branches
Author SHA1 Message Date
Marcin Kuzminski
e9c6d046fc docs: updated API documentation 2017-11-03 15:49:14 +01:00
Marcin Kuzminski
8724af117c docs: added release notes for 4.10.0 2017-11-03 14:39:13 +01:00
Marcin Kuzminski
82baccf66d ssh: prevent exceptions when user associated to stored old key is not found. 2017-11-03 13:07:02 +01:00
Marcin Kuzminski
8686845a97 docs: updated section on performance, scaling, ssl support 2017-10-30 12:52:42 +01:00
Marcin Kuzminski
03068b3426 core: added support for golang go import functionality 2017-10-29 10:14:24 +01:00
Marcin Kuzminski
10cad89493 auth: don't break hashing in case of user with empty password. 
In some cases such as LDAP user created via external scripts users might
set the passwords to empty. The hashing uses the md5(password_hash) to
store reference to detect password changes and forbid using the same password.

In case of pure LDAP users this is not valid, and we shouldn't raise Errors in such
case. This change makes it work for empty passwords now.
 2017-10-27 16:29:46 +02:00
Marcin Kuzminski
28150949f9 release: merge back stable branch into default 2017-10-27 12:44:25 +02:00
Marcin Kuzminski
23bbcdcc35 Added tag v4.9.1 for changeset d9aa3b27ac9f 2017-10-26 15:20:40 +02:00
Marcin Kuzminski
b07edecfd5 release: Finish preparation for 4.9.1 2017-10-26 15:20:39 +02:00
Marcin Kuzminski
a488a6834d release: updated pip2nix output for 4.9.1 2017-10-26 15:20:38 +02:00
Marcin Kuzminski
89d02cbb4a release: Start preparation for 4.9.1 2017-10-26 15:16:45 +02:00
Marcin Kuzminski
434f720559 docs: added release notes for 4.9.1 2017-10-26 13:20:57 +02:00
Marcin Kuzminski
c40f56b538 docs: update celery docs 2017-10-25 15:07:55 +02:00
Marcin Kuzminski
8b7a4217d9 docs: update SSH documentation 2017-10-25 14:59:05 +02:00
Marcin Kuzminski
9262805438 core: use common bootstrap for pyramid app 2017-10-25 11:58:54 +02:00
Marcin Kuzminski
38c78cd493 ssh: allow customizing the base_url for running application. 
Allows proper URLs inside events when executing on SSH calls.
 2017-10-25 11:48:03 +02:00
Marcin Kuzminski
d394c2653a ssh-support: enabled full handling of all backends via SSH. 
- run callback deamons
- run proper authentication checks
- add relative loging.
- fixes #5312
 2017-10-24 23:48:14 +02:00
Marcin Kuzminski
ba710e874d ssh-support: don't use API calls to fetch the data. 
We now rely on pure bootstrap executable that has access to the database and can
check things directly without any API calls.
 2017-10-23 16:09:50 +02:00
Marcin Kuzminski
54357ac219 config: remove obsolete debugtoolbar from pylons. 2017-10-24 23:47:56 +02:00
Marcin Kuzminski
3135dd089e audit-logger: use raw JSON with empty data to control unicode decode warnings. 
Passing in empty dict triggers warnings on sqlalchemy level that we're trying to pass in NON unicode into Unicode column.
 2017-10-24 10:50:57 +02:00
Marcin Kuzminski
7e65f0e21d exceptions: improve handling of exception that are unhandled. 
- inject traceback information into unhandled exceptions.
 2017-10-23 20:43:19 +02:00
Marcin Lulek
18d98e9d17 comments: escape file-paths on commenting to prevent html breakage 2017-10-20 14:11:15 +02:00
Marcin Lulek
b95942a08c pull-requests: security, prevent from injecting comments to other pull requests users 
don't have access to.
 2017-10-19 08:56:32 +02:00
Marcin Lulek
e312dff198 repo-settings: ensure deletion on repo settings model validate 
the settings id against the initialized model repo.

- prevents from malicious deletions of settings by forgin IDs
 2017-10-18 12:16:40 +02:00
Marcin Lulek
897e95f252 select2: always escape .text attributes to prevent XSS via 
vcs references.
 2017-10-18 11:21:18 +02:00
Marcin Kuzminski
ce2de33a5a repo-forks: stable, security, fix issue when forging fork_repo_id could allow reading other people forks. 2017-10-26 10:14:38 +02:00
Marcin Lulek
5cfea94d5c select2: always escape .text attributes to prevent XSS via 
vcs references.
 2017-10-18 11:21:18 +02:00
Marcin Kuzminski
218a7cb13a templates: rename base.mako into summary_base.mako. The previous naming 
wasn't optimal for search and code discovery.
 2017-10-18 09:59:28 +02:00
Marcin Lulek
35981bbe7a pull-requests: security double check permissions on injected forms of source and target repositories. 2017-10-17 20:32:59 +02:00
Marcin Kuzminski
e6fa851ff8 db: prevent empty IN queries that generally are performance problem, and triggers sql warnings. 2017-10-17 20:32:23 +02:00
Marcin Kuzminski
69a865a7a3 repo-groups: moved to pyramid 2017-10-17 14:06:51 +02:00
Marcin Kuzminski
d702ba605f tests: change name of test module of auth-modules to prevent 
pytest complaining about it.
 2017-10-17 15:01:00 +02:00
Marcin Kuzminski
6bfda00b7a repo-forks: security, check for access to fork_id parameter to prevent 
resource discovery.
 2017-10-15 19:40:57 +02:00
Marcin Kuzminski
b326189910 repo-forks: security, fix issue when forging fork_repo_id could allow reading 
other people forks.
 2017-10-15 18:54:52 +02:00
Marcin Kuzminski
4dbba20bd3 repo-settings: fix error on passing in _anchor into wrong call. 
Needs to be for routing and not for HttpFound.
 2017-10-14 22:42:29 +02:00
Marcin Kuzminski
27697682bc auth: don't cache settings for auth plugins 2017-10-13 10:54:52 +02:00
Marcin Kuzminski
3d0069b5f4 caches: clear perms cache manager while updating settings for auth plugins 2017-10-12 22:38:04 +02:00
Marcin Kuzminski
27aff1de7a pull-requests: trigger merge simulation during PR creation. Fixes #5396 2017-10-12 20:57:02 +02:00
Marcin Kuzminski
686c51c8d7 quick-filter: make sure we always apply IN filter query. Otherwise we can 
end up iwth empty query which disables the ACL filter.
 2017-10-12 21:37:23 +02:00
Marcin Kuzminski
924e632980 processes: use better naming detection of running children processes 2017-10-11 14:48:23 +02:00
Marcin Kuzminski
16e0d24e66 processes: use better naming detection of running processes 2017-10-11 14:40:45 +02:00
Marcin Kuzminski
71e944c986 docs: don't use deprecated header for channelstream views 2017-10-10 12:52:23 +02:00
Marcin Kuzminski
259b147568 channelstream: use pyramid http exception instead of webob. 
In Pyramid views we want to use pyramid http exceptions for
better error tracking.
 2017-10-10 12:51:03 +02:00
Marcin Kuzminski
0baf293f82 files: remove rigth-to-left override character for display in files. 
This allows faking the name a bit, we in this particular place want to
skip the override for enhanced security.
 2017-10-10 10:46:54 +02:00
Marcin Kuzminski
cbcd579b02 svn: allow specifying alternative template file for mod_dav config. 2017-10-10 09:30:22 +02:00
Marcin Kuzminski
c66d2e978e files: prevent XSS in fake errors message on filenodes. 2017-10-09 22:37:05 +02:00
Marcin Kuzminski
7b0f075487 docs: added example how to make tmpfs changes permanent 2017-10-09 11:32:43 +02:00
Marcin Kuzminski
698358646e dependencies: added redis library to enable usage of redis backend for beaker. 2017-10-09 11:43:36 +02:00
Marcin Lulek
3df3815e09 auth: don't expose full set of permissions into channelstream payload. 
This leads to resource discovery security vulnerability
 2017-10-08 23:31:45 +02:00
Marcin Lulek
df9121dcf1 auth: don't expose full set of permissions into channelstream payload. 
This leads to resource discovery security vulnerability
 2017-10-08 23:31:45 +02:00