engineering/unrhodecode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
1843 commits 1 branch 0 tags 110 MiB
Commit graph

1843 commits

This branch
This branch
All branches
Author SHA1 Message Date
Marcin Kuzminski
f123e5af43 manifest: added ee_features directory for images 2017-06-27 21:02:25 +02:00
Marcin Kuzminski
8ed9abe306 docs: updated api documentation 2017-06-27 17:19:54 +02:00
Marcin Kuzminski
002332dbc2 markup-renderer: use safe fetching of attributes to prevent from errors on malformed html. 2017-06-27 15:44:49 +02:00
Marcin Kuzminski
2500061c51 auth-token: only delete token if it exists. 2017-06-26 13:55:07 +02:00
Marcin Lulek
cb6d81f435 security: escape flash messaged VCS errors to prevent XSS atacks. 2017-06-26 14:48:15 +02:00
Marcin Kuzminski
5fc0ee97f9 docs: added CI integration docs. 2017-06-23 15:06:31 +02:00
Marcin Kuzminski
fb20d49bf1 docs: updated repo extra fields documentation. 2017-06-23 15:06:22 +02:00
Marcin Kuzminski
710d7ad0b5 docs: updated webhook documentation. 2017-06-23 15:06:05 +02:00
Marcin Kuzminski
ccf69ffec7 audit-logs: don't use old style parser for new audit logs. 2017-06-23 12:22:39 +02:00
Marcin Kuzminski
c315ee8d30 security: use custom writer for RST rendering to prevent injection of javascript: tags. 2017-06-23 11:45:51 +02:00
Marcin Kuzminski
9c7ed2caf3 user-api: use simple schema validator to be consistent how we validate between API and web views. 2017-06-21 15:36:24 +02:00
Marcin Kuzminski
749f784ad9 user-group-api: use simple schema validator to be consistent how we validate 
user group names during creation between API and WEB.
 2017-06-21 13:28:12 +02:00
Marcin Lulek
af07c911dc security: use safe escaped version of description for repo and repo group to potentially 
prevent any XSS attacks on returned data.
 2017-06-21 12:23:46 +02:00
Marcin Kuzminski
25436a7365 audit-logs: implemented full audit logs across application. 
- Fixes #5321
- Api+web actions
- To be extended while we develop new features.
 2017-06-21 12:03:14 +02:00
Marcin Lulek
a9ea42785b security: fix self-xss inside the email add functionality. 2017-06-20 20:59:58 +02:00
Marcin Lulek
3aa700c435 security: escape the returned paths of files and directories. 
Nodes function is used for autocomplete in files view, it prevents from
XSS type of attack in file search.
 2017-06-20 20:02:24 +02:00
Marcin Lulek
ffb80aaa1a security: use 404 instead of 403 in case missing permissions for comment deletion. 
- prevents resource discovery
 2017-06-20 19:39:19 +02:00
Marcin Lulek
60285c8c7f security: don't use literal in notifications. 
- exposes security problems
- we don't store any html anyway in the subject
 2017-06-20 19:09:02 +02:00
Marcin Kuzminski
5c99ddb207 audit-logs: added *basic* support for NOT query term in audit logs. 2017-06-20 16:35:40 +02:00
Marcin Kuzminski
d00d73858a audit-logs: updated action data attrbiutes. 2017-06-20 16:35:14 +02:00
Marcin Kuzminski
e5ba163e0c audit-logs: consistent data between my-account and admin user logs. 2017-06-20 16:06:36 +02:00
Marcin Kuzminski
effa0f53ce users-admin: moved views into pyramid for editing emails and ips. 
- added audit-logging
- added few additional tests
 2017-06-20 13:53:44 +02:00
Marcin Kuzminski
37c0465603 my-account: use audit logs for email and token actions. 2017-06-20 13:23:15 +02:00
Marcin Kuzminski
214e9059ec my-account: moved few my account views into pyramid. 2017-06-20 00:11:36 +02:00
Marcin Lulek
e919908333 security: make sure the admin of repo can only delete comments which are from the same repo. 
- fixes IDOR issue
- protects against other people comment deletion by repo admins.
 2017-06-19 21:15:37 +02:00
Marcin Lulek
cc53162981 security: use 404 instead of 403 code on permission decorator to prevent resource discovery attacks. 2017-06-19 18:15:57 +02:00
Marcin Kuzminski
f442430df8 my-account: moved emails config into pyramid views. 2017-06-19 15:30:09 +02:00
Marcin Lulek
ad54b9a57d security: use new safe escaped user attributes across the application. 
- will fix all possible XSS attack vectors.
 2017-06-19 15:14:02 +02:00
Marcin Lulek
91e65dd798 User: use new escaped hybrid properties for usage in code. 
- Allows introducing the safer method of reading first/last names from users.
 2017-06-19 10:56:31 +02:00
Marcin Kuzminski
aa3bffd198 pull-requests: prepare the migration of pull request to pyramid. 
- this is half the code because of problems found during porting
- partially moved the urls, and flipped the logic into pyramid code
- needs more work in core for full switch.
 2017-06-19 13:25:15 +02:00
Marcin Kuzminski
dabc0de3df notifications: fixed problem with 500 errors on non-numeric 
notification id given.
 2017-06-19 10:10:19 +02:00
Marcin Lulek
0e6fcd4658 security: added missing csrf checks in few missing views. 2017-06-19 09:20:07 +02:00
Marcin Lulek
779587086e security: fixed self-xss inside file views. 2017-06-17 17:06:57 +02:00
Marcin Lulek
ea90ac1210 security: fix self-xss inside repo strip view. 2017-06-17 16:06:06 +02:00
Daniel Dourvaris
1eff40ea89 docs: added example how to secure login page from brute force attacks. 2017-06-15 23:32:01 +02:00
Marcin Kuzminski
926a79e98e audit-logs: implemented pull request and comment events. 2017-06-17 15:22:50 +02:00
Marcin Kuzminski
8a3441e96e audit-logs: use specific web/api calls. 
- also normalized action_data to specs.
 2017-06-14 16:33:23 +02:00
Marcin Kuzminski
8ae7a08fd3 audit-logs: added audit logs on user groups admin page. 2017-06-14 15:25:31 +02:00
Marcin Kuzminski
32d96c3e6a action_logger: removed really not required actions of start/stop following a repository. 
- this information just spams user information, and for product such as rhodecode this
doesn't make any sense to be stored.
 2017-06-14 15:04:03 +02:00
Marcin Kuzminski
1be028f546 audit-logs: moved async tasks from old deprecated action_logger. 2017-06-14 15:45:17 +02:00
Marcin Kuzminski
8ec82f1089 audit-logs: fill in some default values for the expected action data. 2017-06-14 15:46:06 +02:00
Marcin Kuzminski
4bd5c08e87 audit-logs: added audit-logs on user actions. 
- adding/deleting ips
- adding/deleting emails
- edit/create
 2017-06-14 14:38:59 +02:00
Marcin Kuzminski
7618001212 audit-logger: added convinience wrappers to store web or api action. 2017-06-14 14:15:11 +02:00
Marcin Kuzminski
3e76f23368 audit-logs: added action logs for repository groups. 2017-06-14 12:39:51 +02:00
Marcin Kuzminski
dbcc488137 audit-logs: implement enum sources that should be re-used. 2017-06-14 11:51:46 +02:00
Marcin Kuzminski
c36f3f7abd tests: removed soon-to-be deleted test for deprecated action_logger. 2017-06-14 14:39:19 +02:00
Marcin Kuzminski
10162bb050 cleanup: imports cleanup. 2017-06-14 11:23:27 +02:00
Daniel Dourvaris
2beb24a857 reviewers: added validation and default review rules via API calls. 
- update/create pull request now validate and update the default reviewer rules.
 2017-06-14 11:10:19 +02:00
Daniel Dourvaris
930c7eebbd api: attach the call context variables to request for later usage 
in API calls.
 2017-06-14 11:07:54 +02:00
Daniel Dourvaris
091c9d9d99 pull-requests: make sure to skip duplicates of reviewers via PR create method. 2017-06-14 00:15:06 +02:00