engineering/unrhodecode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
2251 commits 1 branch 0 tags 110 MiB
Commit graph

212 commits

Author SHA1 Message Date
Marcin Kuzminski
de3914dccb dependencies: dropped nose dependency. 2017-11-06 22:50:54 +01:00
Marcin Kuzminski
15972afecb ssh: use proper way of extracting the HOOK_PROTOCOL out of vcssettings. 
- it might be not stored inside the .ini file so we should use the config
that has proper defaults, and it's used in many other places.
 2017-11-06 11:43:38 +01:00
Marcin Kuzminski
043d5232de ssh: always expand the path for the generated authorized_keys file. 
Without it we can lead to path problems on reading the ~.
 2017-11-06 11:13:05 +01:00
Marcin Kuzminski
82baccf66d ssh: prevent exceptions when user associated to stored old key is not found. 2017-11-03 13:07:02 +01:00
Marcin Kuzminski
38c78cd493 ssh: allow customizing the base_url for running application. 
Allows proper URLs inside events when executing on SSH calls.
 2017-10-25 11:48:03 +02:00
Marcin Kuzminski
d394c2653a ssh-support: enabled full handling of all backends via SSH. 
- run callback deamons
- run proper authentication checks
- add relative loging.
- fixes #5312
 2017-10-24 23:48:14 +02:00
Marcin Kuzminski
ba710e874d ssh-support: don't use API calls to fetch the data. 
We now rely on pure bootstrap executable that has access to the database and can
check things directly without any API calls.
 2017-10-23 16:09:50 +02:00
Marcin Lulek
b95942a08c pull-requests: security, prevent from injecting comments to other pull requests users 
don't have access to.
 2017-10-19 08:56:32 +02:00
Marcin Lulek
35981bbe7a pull-requests: security double check permissions on injected forms of source and target repositories. 2017-10-17 20:32:59 +02:00
Marcin Kuzminski
e6fa851ff8 db: prevent empty IN queries that generally are performance problem, and triggers sql warnings. 2017-10-17 20:32:23 +02:00
Marcin Kuzminski
69a865a7a3 repo-groups: moved to pyramid 2017-10-17 14:06:51 +02:00
Marcin Kuzminski
6bfda00b7a repo-forks: security, check for access to fork_id parameter to prevent 
resource discovery.
 2017-10-15 19:40:57 +02:00
Marcin Kuzminski
b326189910 repo-forks: security, fix issue when forging fork_repo_id could allow reading 
other people forks.
 2017-10-15 18:54:52 +02:00
Marcin Kuzminski
4dbba20bd3 repo-settings: fix error on passing in _anchor into wrong call. 
Needs to be for routing and not for HttpFound.
 2017-10-14 22:42:29 +02:00
Marcin Kuzminski
27aff1de7a pull-requests: trigger merge simulation during PR creation. Fixes #5396 2017-10-12 20:57:02 +02:00
Marcin Kuzminski
686c51c8d7 quick-filter: make sure we always apply IN filter query. Otherwise we can 
end up iwth empty query which disables the ACL filter.
 2017-10-12 21:37:23 +02:00
Marcin Kuzminski
71e944c986 docs: don't use deprecated header for channelstream views 2017-10-10 12:52:23 +02:00
Marcin Kuzminski
259b147568 channelstream: use pyramid http exception instead of webob. 
In Pyramid views we want to use pyramid http exceptions for
better error tracking.
 2017-10-10 12:51:03 +02:00
Marcin Kuzminski
cbcd579b02 svn: allow specifying alternative template file for mod_dav config. 2017-10-10 09:30:22 +02:00
Marcin Kuzminski
c66d2e978e files: prevent XSS in fake errors message on filenodes. 2017-10-09 22:37:05 +02:00
Marcin Lulek
df9121dcf1 auth: don't expose full set of permissions into channelstream payload. 
This leads to resource discovery security vulnerability
 2017-10-08 23:31:45 +02:00
Marcin Kuzminski
abf63a445f audit-logs: expose tailoed audit logs in repository view 2017-10-08 12:11:04 +02:00
Marcin Lulek
b900d908c5 security: fix XSS in repo strip view. 2017-10-07 13:14:08 +02:00
Marcin Kuzminski
fe428ab4d7 files: protect against 500 errors on nodelist. 2017-10-07 10:33:47 +02:00
Marcin Kuzminski
10231cba28 changelog: prevent from 500 errors on changelog when fetching certain commits. 2017-10-07 10:13:39 +02:00
Marcin Kuzminski
eb50f6c575 commits: add protection against 500 errors on commit children/parents page. 2017-10-06 15:44:17 +02:00
Marcin Kuzminski
f175d99411 login: don't use request.params because it allows to passing multiple 
values for GET which can confuse the system.
 2017-10-06 15:19:36 +02:00
Marcin Kuzminski
3fea802084 repo-summary: protect against wrong commits in repo summary. 2017-10-06 15:02:25 +02:00
Marcin Kuzminski
569e2a30ba i18n: fix typo 2017-10-05 11:21:40 +02:00
Marcin Kuzminski
862e0c122b commits: hide evolve commits. Fixes #5392 2017-10-03 16:37:39 +02:00
Marcin Kuzminski
a00cc457a9 ssh-keys: expose last access time on admin summary page for SSH keys. 2017-09-27 22:21:04 +02:00
Marcin Kuzminski
6eac893f8f changelog: fix consistency of returned data to 2 element tuple. 2017-09-27 17:26:07 +02:00
Marcin Kuzminski
3783c23d90 changelog: only load graph data when showing changelog for both commit and commit loaded via ajax chunks. 2017-09-27 13:28:45 +02:00
Marcin Kuzminski
3718a47d3f changelog: fix and optimize loading of chunks for file history. 
- load-next/prev wasn't working
- make sure pagination works as expected
- speed up certain actions by pre-loading more attributes
 2017-09-27 13:21:57 +02:00
Marcin Kuzminski
59ed8f2d47 changelog: fix url generation for file changelog and ensure 
http redirect works as expected for unfound nodes.
 2017-09-25 13:55:31 +02:00
Marcin Kuzminski
a9fc01d079 repo-auth-tokens: UX, set and disable to VCS scope if selected an repo from select2 2017-09-21 20:12:13 +02:00
Marcin Kuzminski
79c8fadc26 repo-data: fixed missing parameter we used to propagate JS with. 
- was breaking the repo selectors
 2017-09-21 19:46:27 +02:00
Marcin Kuzminski
b505377197 users: ported controllers from pylons into pyramid views. 2017-09-20 22:29:34 +02:00
Marcin Kuzminski
37ef509c3f tests: fixed some more test issues during stress tests runs. 2017-09-21 11:52:32 +02:00
Marcin Kuzminski
a8d0784226 tests: fixed tests for random dict order could sometimes break the tests 2017-09-20 23:33:29 +02:00
Marcin Kuzminski
b95e835ebb audit-logs: allow showing individual entries for audit log. 2017-09-21 16:47:10 +02:00
Marcin Kuzminski
cb071ab951 user-groups: use request partial renderer and not the pylons one. 2017-09-20 20:18:53 +02:00
Marcin Kuzminski
bcac21cb46 user-groups-audit: properly register add/delete members on main 
edit screen for user group. ref #5390
 2017-09-20 17:14:55 +02:00
Marcin Kuzminski
2f5d2e7d67 routing: removed more usage of pylons url() objects. 2017-09-20 15:21:03 +02:00
Marcin Kuzminski
4679c5bfcb home: removed old pylons routes and convert them to pyramid ops app 2017-09-19 12:47:18 +02:00
Marcin Kuzminski
cfe326566d helpers: remove usage of pylons session. 2017-09-19 17:11:48 +02:00
Marcin Kuzminski
0fd76867b6 auth-tokens: allow specifing custom expiration date manually. 
- fixes #5323
 2017-09-08 18:03:35 +02:00
Marcin Kuzminski
3821db3f37 apps: removed deprecated usage of c.repo_info 2017-09-08 13:33:17 +02:00
Marcin Kuzminski
87a5eb4bde apps: cleanup imports 2017-09-08 12:56:47 +02:00
Marcin Kuzminski
e8fe72ebfb admin: cleanup imports. 2017-09-08 12:49:41 +02:00