engineering/unrhodecode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
2251 commits 1 branch 0 tags 110 MiB
Commit graph

1735 commits

Author SHA1 Message Date
Marcin Kuzminski
de3914dccb dependencies: dropped nose dependency. 2017-11-06 22:50:54 +01:00
Marcin Kuzminski
a3f99312b6 release: Bump version 4.10.0 to 4.11.0 2017-11-06 15:41:27 +01:00
Marcin Kuzminski
436b4da762 i18n: Update compiled message objects and js i18n files 2017-11-06 12:46:51 +01:00
Marcin Kuzminski
3e2fd18e85 i18n: Pulled translation from Transifex 2017-11-06 12:46:11 +01:00
Marcin Kuzminski
437c3ab9e3 i18n: Updated message catalog template 2017-11-06 12:45:12 +01:00
Marcin Kuzminski
15972afecb ssh: use proper way of extracting the HOOK_PROTOCOL out of vcssettings. 
- it might be not stored inside the .ini file so we should use the config
that has proper defaults, and it's used in many other places.
 2017-11-06 11:43:38 +01:00
Marcin Kuzminski
043d5232de ssh: always expand the path for the generated authorized_keys file. 
Without it we can lead to path problems on reading the ~.
 2017-11-06 11:13:05 +01:00
Marcin Kuzminski
fc7aa0a765 i18n: updated message catalog 2017-11-03 16:45:15 +01:00
Marcin Kuzminski
0de9d54cdd i18n: updated JS translations 2017-11-03 16:41:40 +01:00
Marcin Kuzminski
82baccf66d ssh: prevent exceptions when user associated to stored old key is not found. 2017-11-03 13:07:02 +01:00
Marcin Kuzminski
03068b3426 core: added support for golang go import functionality 2017-10-29 10:14:24 +01:00
Marcin Kuzminski
10cad89493 auth: don't break hashing in case of user with empty password. 
In some cases such as LDAP user created via external scripts users might
set the passwords to empty. The hashing uses the md5(password_hash) to
store reference to detect password changes and forbid using the same password.

In case of pure LDAP users this is not valid, and we shouldn't raise Errors in such
case. This change makes it work for empty passwords now.
 2017-10-27 16:29:46 +02:00
Marcin Kuzminski
9262805438 core: use common bootstrap for pyramid app 2017-10-25 11:58:54 +02:00
Marcin Kuzminski
38c78cd493 ssh: allow customizing the base_url for running application. 
Allows proper URLs inside events when executing on SSH calls.
 2017-10-25 11:48:03 +02:00
Marcin Kuzminski
d394c2653a ssh-support: enabled full handling of all backends via SSH. 
- run callback deamons
- run proper authentication checks
- add relative loging.
- fixes #5312
 2017-10-24 23:48:14 +02:00
Marcin Kuzminski
ba710e874d ssh-support: don't use API calls to fetch the data. 
We now rely on pure bootstrap executable that has access to the database and can
check things directly without any API calls.
 2017-10-23 16:09:50 +02:00
Marcin Kuzminski
3135dd089e audit-logger: use raw JSON with empty data to control unicode decode warnings. 
Passing in empty dict triggers warnings on sqlalchemy level that we're trying to pass in NON unicode into Unicode column.
 2017-10-24 10:50:57 +02:00
Marcin Kuzminski
7e65f0e21d exceptions: improve handling of exception that are unhandled. 
- inject traceback information into unhandled exceptions.
 2017-10-23 20:43:19 +02:00
Marcin Lulek
18d98e9d17 comments: escape file-paths on commenting to prevent html breakage 2017-10-20 14:11:15 +02:00
Marcin Lulek
b95942a08c pull-requests: security, prevent from injecting comments to other pull requests users 
don't have access to.
 2017-10-19 08:56:32 +02:00
Marcin Lulek
e312dff198 repo-settings: ensure deletion on repo settings model validate 
the settings id against the initialized model repo.

- prevents from malicious deletions of settings by forgin IDs
 2017-10-18 12:16:40 +02:00
Marcin Lulek
5cfea94d5c select2: always escape .text attributes to prevent XSS via 
vcs references.
 2017-10-18 11:21:18 +02:00
Marcin Kuzminski
218a7cb13a templates: rename base.mako into summary_base.mako. The previous naming 
wasn't optimal for search and code discovery.
 2017-10-18 09:59:28 +02:00
Marcin Lulek
35981bbe7a pull-requests: security double check permissions on injected forms of source and target repositories. 2017-10-17 20:32:59 +02:00
Marcin Kuzminski
e6fa851ff8 db: prevent empty IN queries that generally are performance problem, and triggers sql warnings. 2017-10-17 20:32:23 +02:00
Marcin Kuzminski
69a865a7a3 repo-groups: moved to pyramid 2017-10-17 14:06:51 +02:00
Marcin Kuzminski
d702ba605f tests: change name of test module of auth-modules to prevent 
pytest complaining about it.
 2017-10-17 15:01:00 +02:00
Marcin Kuzminski
6bfda00b7a repo-forks: security, check for access to fork_id parameter to prevent 
resource discovery.
 2017-10-15 19:40:57 +02:00
Marcin Kuzminski
b326189910 repo-forks: security, fix issue when forging fork_repo_id could allow reading 
other people forks.
 2017-10-15 18:54:52 +02:00
Marcin Kuzminski
4dbba20bd3 repo-settings: fix error on passing in _anchor into wrong call. 
Needs to be for routing and not for HttpFound.
 2017-10-14 22:42:29 +02:00
Marcin Kuzminski
27697682bc auth: don't cache settings for auth plugins 2017-10-13 10:54:52 +02:00
Marcin Kuzminski
3d0069b5f4 caches: clear perms cache manager while updating settings for auth plugins 2017-10-12 22:38:04 +02:00
Marcin Kuzminski
27aff1de7a pull-requests: trigger merge simulation during PR creation. Fixes #5396 2017-10-12 20:57:02 +02:00
Marcin Kuzminski
686c51c8d7 quick-filter: make sure we always apply IN filter query. Otherwise we can 
end up iwth empty query which disables the ACL filter.
 2017-10-12 21:37:23 +02:00
Marcin Kuzminski
924e632980 processes: use better naming detection of running children processes 2017-10-11 14:48:23 +02:00
Marcin Kuzminski
16e0d24e66 processes: use better naming detection of running processes 2017-10-11 14:40:45 +02:00
Marcin Kuzminski
71e944c986 docs: don't use deprecated header for channelstream views 2017-10-10 12:52:23 +02:00
Marcin Kuzminski
259b147568 channelstream: use pyramid http exception instead of webob. 
In Pyramid views we want to use pyramid http exceptions for
better error tracking.
 2017-10-10 12:51:03 +02:00
Marcin Kuzminski
0baf293f82 files: remove rigth-to-left override character for display in files. 
This allows faking the name a bit, we in this particular place want to
skip the override for enhanced security.
 2017-10-10 10:46:54 +02:00
Marcin Kuzminski
cbcd579b02 svn: allow specifying alternative template file for mod_dav config. 2017-10-10 09:30:22 +02:00
Marcin Kuzminski
c66d2e978e files: prevent XSS in fake errors message on filenodes. 2017-10-09 22:37:05 +02:00
Marcin Lulek
df9121dcf1 auth: don't expose full set of permissions into channelstream payload. 
This leads to resource discovery security vulnerability
 2017-10-08 23:31:45 +02:00
Marcin Kuzminski
abf63a445f audit-logs: expose tailoed audit logs in repository view 2017-10-08 12:11:04 +02:00
Marcin Lulek
b900d908c5 security: fix XSS in repo strip view. 2017-10-07 13:14:08 +02:00
Marcin Kuzminski
7781eabe94 auth: use cache_ttl from a plugin to also cache permissions. 
- this gives a 30% speed increase in operations like svn commit
- generally uses the same mechanismy like auth cache to cache permissions for faster
access to vcs commands
 2017-10-07 10:02:39 +02:00
Marcin Kuzminski
34175fd787 auth-rhodecode: don't fail on bcrypt if user password is set to None. 
Default to emptry string to not cause an exception.
 2017-10-07 10:02:57 +02:00
Marcin Kuzminski
fe428ab4d7 files: protect against 500 errors on nodelist. 2017-10-07 10:33:47 +02:00
Marcin Kuzminski
10231cba28 changelog: prevent from 500 errors on changelog when fetching certain commits. 2017-10-07 10:13:39 +02:00
Marcin Kuzminski
eb50f6c575 commits: add protection against 500 errors on commit children/parents page. 2017-10-06 15:44:17 +02:00
Marcin Kuzminski
f175d99411 login: don't use request.params because it allows to passing multiple 
values for GET which can confuse the system.
 2017-10-06 15:19:36 +02:00