engineering/unrhodecode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
2251 commits 1 branch 0 tags 110 MiB
Commit graph

306 commits

Author SHA1 Message Date
Marcin Lulek
b95942a08c pull-requests: security, prevent from injecting comments to other pull requests users 
don't have access to.
 2017-10-19 08:56:32 +02:00
Marcin Lulek
e312dff198 repo-settings: ensure deletion on repo settings model validate 
the settings id against the initialized model repo.

- prevents from malicious deletions of settings by forgin IDs
 2017-10-18 12:16:40 +02:00
Marcin Kuzminski
69a865a7a3 repo-groups: moved to pyramid 2017-10-17 14:06:51 +02:00
Marcin Kuzminski
27aff1de7a pull-requests: trigger merge simulation during PR creation. Fixes #5396 2017-10-12 20:57:02 +02:00
Marcin Kuzminski
686c51c8d7 quick-filter: make sure we always apply IN filter query. Otherwise we can 
end up iwth empty query which disables the ACL filter.
 2017-10-12 21:37:23 +02:00
Marcin Kuzminski
abf63a445f audit-logs: expose tailoed audit logs in repository view 2017-10-08 12:11:04 +02:00
Marcin Kuzminski
7781eabe94 auth: use cache_ttl from a plugin to also cache permissions. 
- this gives a 30% speed increase in operations like svn commit
- generally uses the same mechanismy like auth cache to cache permissions for faster
access to vcs commands
 2017-10-07 10:02:39 +02:00
Marcin Kuzminski
34175fd787 auth-rhodecode: don't fail on bcrypt if user password is set to None. 
Default to emptry string to not cause an exception.
 2017-10-07 10:02:57 +02:00
Marcin Kuzminski
bab4242396 user-groups: fix potential problem with group sync of external plugins. 
- when using external plugin we used to check for a parameter that set the
sync mode. The problem is we only checked if the flag was there. So
toggling sync on and off set the value and then left the key still set
but with None. This confused the sync and thought the group should be
synced !
 2017-09-29 21:40:06 +02:00
Marcin Lulek
725145927b security: limit the maximum password lenght to 72 characters to prevent possible 
server side resource consumption attack.

- bcrypt heavy computation can lead to DOS using a very long password .eg 10**8 lenght.
- we allowed this on registration or on password update
 2017-09-27 10:52:17 +02:00
Marcin Kuzminski
b505377197 users: ported controllers from pylons into pyramid views. 2017-09-20 22:29:34 +02:00
Marcin Kuzminski
30a23f9ca6 audit-logs: ensure nullable FK IDs for mysql 2017-09-21 13:19:38 +02:00
Marcin Kuzminski
b95e835ebb audit-logs: allow showing individual entries for audit log. 2017-09-21 16:47:10 +02:00
Marcin Kuzminski
13e4927d13 logging: use logger_generic in all suitable places, and fix get_current_rhodecode_user() 
function to use the new mechanics from pyramid. Fixes #5390
 2017-09-20 17:39:46 +02:00
Marcin Kuzminski
2f5d2e7d67 routing: removed more usage of pylons url() objects. 2017-09-20 15:21:03 +02:00
Marcin Kuzminski
6dada9f346 meta-tags: cleanup support for metatags. 
- fixes problem of html-escape + supported link
- no longer extract url from description, you have to use new url => tag
- tags are extracted to the beginning of the description during rendering
- show helpers in proper places in groups/repos/forks
 2017-09-14 17:31:52 +02:00
Marcin Lulek
f42a5ca66b db: use LONGTEXT for mysql in user_logs. Fixes #5385, problem with mysql rejecting 
insert because of too long json data.

- simple case of lots of users in user group can cause mysql to fail on insert
 2017-09-12 13:35:35 +02:00
Marcin Kuzminski
0fd76867b6 auth-tokens: allow specifing custom expiration date manually. 
- fixes #5323
 2017-09-08 18:03:35 +02:00
Marcin Kuzminski
56bbe6261a pull-request-events: add audit data for pull_request.close action 2017-09-08 16:04:22 +02:00
Marcin Kuzminski
2b8223498e pep8: cleanup code for permissions 2017-09-08 12:42:40 +02:00
Marcin Kuzminski
a8abeb0d1c user-groups: rewrote the app to pyramid 
- added new event data with added/removed/changed permissions
- cleanup code and spelling
 2017-08-31 12:47:19 +02:00
Marcin Kuzminski
395cf5ac23 permissions: use same way of sorting of user_group permissions like user ones. 
- makes the display of objects in permission summary nicer to look at
 2017-08-24 22:28:28 +02:00
Marcin Kuzminski
990994942d pull-requests: use close action with proper --close-commit solution. 
- Mercurial settings are no long as LABS
- Unified some code between GIT and HG on rebase/close/delete feature branches
 2017-08-24 22:36:34 +02:00
Mathieu Cantin
761e973359 mercurial: Add option to close a branch before merging 2017-08-08 13:46:42 -04:00
Marcin Kuzminski
a9f61590e0 user/user-groups: show if users or user groups are a part of review rules. 
- cascade delete when deleting those so we still can remove the user or user group
- fixes #5377
 2017-08-24 21:01:22 +02:00
Marcin Kuzminski
57031945a3 pull-requests: use merge info to show how Pull requests will be merged. 
- rebase or merge commit is shown as merge strategy.
- close/delete branch are shown if that option is selected.
 2017-08-23 13:48:10 +02:00
Marcin Kuzminski
b7c17b192d ssh: added ssh key management into my account. 2017-08-19 17:47:01 +02:00
Marcin Kuzminski
aca661a15e goto-switcher: optimized performance and query capabilities. 
- Previous implementation had on significant bug. The use of LIMIT 20
was limiting results BEFORE auth checks. In case of large ammount of similarly
named repositories user didn't had access too, the result goto search was empty.

This was becuase first 20 items fetched didn't pass permission checks and final
auth list was empty.

To fix this we now use proper filtering for auth using SQL. It means we first check
user allowed repositories, and add this as a filter so end result from database is already
to only the accessible repositories.
 2017-08-16 22:46:34 +02:00
Marcin Kuzminski
928129ed6c repositories: rewrote whole admin section to pyramid. 
- fixed few small found problems
- code cleanups
 2017-08-11 13:00:47 +02:00
Marcin Kuzminski
2b15a05b94 comments: remove usage of pylons global config. 2017-08-04 14:29:09 +02:00
Marcin Kuzminski
c56bb0da4b core: removed usage of global pylons config in base lib. 2017-08-03 21:59:49 +02:00
Marcin Kuzminski
ee0e7c21f8 users: make AuthUser propert a method, and allow override of params. 2017-08-03 20:17:46 +02:00
Marcin Kuzminski
35cefa9b2d users: added SSH key management for user admin pages 2017-08-03 16:35:13 +02:00
Marcin Kuzminski
384dcf30c0 db: use consistent order of auth-tokens and emails when fetching those from user. 2017-07-27 18:13:25 +02:00
Marcin Kuzminski
42d56172a4 user-groups: moved the display of user group into a pyramid view 2017-07-27 18:56:31 +02:00
Marcin Kuzminski
b203d5f208 pull-requests: migrated code from pylons to pyramid 2017-07-27 11:30:55 +02:00
Marcin Kuzminski
fa5dd62880 channelstream: push events with comments on single commits. 
- use wrapper for posting to simplify the code.
 2017-07-26 18:04:56 +02:00
Marcin Kuzminski
ae8340ad2a db: use a wrapper on pull requests _last_merge_status to ensure this is always INT. 
- after upgrade of sqlalchemy this is casted to Long
- for backward compat we cast it as Int
 2017-07-26 12:16:25 +02:00
Marcin Kuzminski
708f22ac87 db: use unicode for some of the defaults to reduce sqlalchemy warnings. 2017-07-26 12:14:56 +02:00
Marcin Kuzminski
78e4f7d2f1 db: removed two redundant indexes found by never sqlalchemy 2017-07-26 07:45:42 +02:00
Marcin Kuzminski
4de255d013 core: no longer rely on webob exception inside get_or_404 function. 
- relly on pyramid exc only
- helps reduce number of appenlight problems with 404 handling via webob
 2017-07-25 15:26:38 +02:00
Marcin Kuzminski
0c1f7e3306 auth: improve logging 2017-07-25 15:07:43 +02:00
Marcin Kuzminski
3f26df9f37 user: deprecated usage of api_keys. 
- additionally we don't load secrets as they are never used (and are expensive to fetch)
- simplify fetching of details improves performance
 2017-07-25 16:27:08 +02:00
Marcin Kuzminski
3b524b7875 renderer: remove usage of old non request PartialRenderer 2017-07-24 09:59:48 +02:00
Marcin Kuzminski
72eb573560 users: made the function for account deactivation easier to use inside ishell. 2017-07-24 11:51:07 +02:00
Marcin Kuzminski
ff79205313 global-permissions: ported controller to pyramid view. 
- fixed some other tests cases to rely on test routing
 2017-07-20 15:04:36 +02:00
Marcin Kuzminski
4f16a9a411 repository-groups: introduce last change for repository groups. 2017-07-20 12:59:53 +02:00
Daniel Dourvaris
7add053ff8 users: add additional information why user with pending reviews shouldn't be deleted. 2017-07-13 22:40:12 +02:00
Marcin Kuzminski
8ff5e04569 notifications: removed usage of pylons translation from models. 2017-07-13 17:58:15 +02:00
Marcin Kuzminski
580a0d0ea5 notifications: ported views to pyramid 2017-07-13 18:28:31 +02:00