http://hg.code.sf.net:8000/p/roundup/code/atom-log/tip/doc/security.txt Mercurial Repository: p/roundup/code: doc/security.txt history 2025-07-12T23:22:14-04:00 build: 2.5.0 release checkin. Tag to come. http://hg.code.sf.net:8000/p/roundup/code/#changeset-c7a2e01793cdb5228d44df085e3b2f8a73e51c28 John Rouillard rouilj@ieee.org 2025-07-12T23:22:14-04:00 2025-07-12T23:22:14-04:00
changeset c7a2e01793cd
branch
bookmark
tag 2.5.0
user John Rouillard <rouilj@ieee.org>
description build: 2.5.0 release checkin. Tag to come.
files
doc: update/clarify verifcation directions. http://hg.code.sf.net:8000/p/roundup/code/#changeset-58a1b4051a57833ad77c64bbbe00e1f0f7266e23 John Rouillard rouilj@ieee.org 2025-07-11T22:26:46-04:00 2025-07-11T22:26:46-04:00
changeset 58a1b4051a57
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description doc: update/clarify verifcation directions.
files
bug(security): CVE-2025-53865 - XSS bug http://hg.code.sf.net:8000/p/roundup/code/#changeset-4ac0bbb3e440678d1f591777ceb5b43e360d3d25 John Rouillard rouilj@ieee.org 2025-07-11T19:30:27-04:00 2025-07-11T19:30:27-04:00
changeset 4ac0bbb3e440
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description bug(security): CVE-2025-53865 - XSS bug

Extensive fixes in devel, responsive templates known to be
exploitable.

Similar constructs in classic and minimal templates not known
to be exploitable, but changed anyway.

doc/upgrading.txt:

Reformat to 66 characters.

Update with assigned CVE number.

Add section on fixing tal:replace with unsafe data.

Document analysis and assumptions in comment in file.

doc/security.txt:

Update with CVE number.
files
bug(security): fix XSS exploit in devel and responsive templates http://hg.code.sf.net:8000/p/roundup/code/#changeset-abf1297e7a940f7bbe42fed4e319d9de96cdc740 John Rouillard rouilj@ieee.org 2025-07-08T13:38:08-04:00 2025-07-08T13:38:08-04:00
changeset abf1297e7a94
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description bug(security): fix XSS exploit in devel and responsive templates

Replace all occurances of:

tal:content="structure context/MUMBLE/plain"

with

tal:content="context/MUMBLE/plain"

This seems to have been an old way to handle display of a field when
the user did not have edit rights. It does not occur in current (later
than 2009) classic tracker templates. But probably was unsed in
earlier classic templates since devel, reponsive and the roundup issue
tracker templates were based on classic.

Add CVE placeholder to security.txt and link to fix directions added
to upgrading.txt. Add note in announcement.txt and CHANGES.txt

Add a details element around the table of contents in the upgrading
guide. It was getting long.

Updated a missed XSS issue in the roundup tracker template. Live site
is already fixed.

XSS bug reported by 4bug of ChaMd5 Security Team H1 Group
files
docs: add 2.4.0 gpg signature. http://hg.code.sf.net:8000/p/roundup/code/#changeset-4dfc07ee489ad000c8ffe7ee97b506c94fae6774 John Rouillard rouilj@ieee.org 2024-07-13T00:18:49-04:00 2024-07-13T00:18:49-04:00
changeset 4dfc07ee489a
branch
bookmark
tag 2.4.0
user John Rouillard <rouilj@ieee.org>
description docs: add 2.4.0 gpg signature.
files
fix(security): fix CVE-2024-39124, CVE-2024-39124, and CVE-2024-39125 http://hg.code.sf.net:8000/p/roundup/code/#changeset-28aa76443f58bc1605a9933bb4ea4d599c97af5a John Rouillard rouilj@ieee.org 2024-07-09T09:07:09-04:00 2024-07-09T09:07:09-04:00
changeset 28aa76443f58
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description fix(security): fix CVE-2024-39124, CVE-2024-39124, and CVE-2024-39125

Directions for fixing:

* `CVE-2024-39124`_ - :ref:`classhelpers (_generic.help.html) are
vulnerable to an XSS attack. <CVE-2024-39124>` Requires fixing
tracker homes.
* `CVE-2024-39125`_ - :ref:`if Referer header is set to a script
tag, it will be executed. <CVE-2024-39125>` Fixed in release 2.4.0,
directions available for fixing in prior versions.
* `CVE-2024-39126`_ - :ref:`PDF, XML and SVG files downloaded from
an issue can contain embedded JavaScript which is
executed. <CVE-2024-39126>` Fixed in release 2.4.0, directions
available for fixing in prior versions.

prior to 2.4.0 release this weekend that fixes the last two CVE's.
files
2.4.0b2 release updates http://hg.code.sf.net:8000/p/roundup/code/#changeset-301b0988a35168090b82b9858093e8dd7b5731ce John Rouillard rouilj@ieee.org 2024-05-27T22:47:08-04:00 2024-05-27T22:47:08-04:00
changeset 301b0988a351
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description 2.4.0b2 release updates
files
2.4.0b1 release commits http://hg.code.sf.net:8000/p/roundup/code/#changeset-75774e89b4830600a96db9c149ec61c265f12f8f John Rouillard rouilj@ieee.org 2024-05-27T16:26:55-04:00 2024-05-27T16:26:55-04:00
changeset 75774e89b483
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description 2.4.0b1 release commits
files
Updates for 2.3.0 release. http://hg.code.sf.net:8000/p/roundup/code/#changeset-ed2bc951277b6be1778c23b3e8263f840205f974 John Rouillard rouilj@ieee.org 2023-07-12T22:59:49-04:00 2023-07-12T22:59:49-04:00
changeset ed2bc951277b
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description Updates for 2.3.0 release.
files
Changes for roundup release 2.3.0b2 http://hg.code.sf.net:8000/p/roundup/code/#changeset-51fc06fabcee043db116e2fbdcdcf5e86b67ed3d John Rouillard rouilj@ieee.org 2023-05-31T19:44:02-04:00 2023-05-31T19:44:02-04:00
changeset 51fc06fabcee
branch
bookmark
tag 2.3.0b2
user John Rouillard <rouilj@ieee.org>
description Changes for roundup release 2.3.0b2

I missed changing announcements.txt so the b1 release has the 2.2.0
release announcment when I uploaded to test.pipi.org.
files
Add front matter and header "Reporting Security Issues" http://hg.code.sf.net:8000/p/roundup/code/#changeset-1c291a05d90f0f03f735cf7b2ad9095e3e157b3b John Rouillard rouilj@ieee.org 2023-05-29T19:53:43-04:00 2023-05-29T19:53:43-04:00
changeset 1c291a05d90f
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description Add front matter and header "Reporting Security Issues"
files
add headers; make signature list multicolum http://hg.code.sf.net:8000/p/roundup/code/#changeset-bd5bebb1169550dad476b7c36d028e59761d62b6 John Rouillard rouilj@ieee.org 2023-05-29T19:28:38-04:00 2023-05-29T19:28:38-04:00
changeset bd5bebb11695
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description add headers; make signature list multicolum
files
Fix missed format changes. http://hg.code.sf.net:8000/p/roundup/code/#changeset-32bd5013bf32035606f96956226ba0e7685160f1 John Rouillard rouilj@ieee.org 2023-05-29T19:01:59-04:00 2023-05-29T19:01:59-04:00
changeset 32bd5013bf32
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description Fix missed format changes.
files
issue2551279 - GPG support removed from pypi - rewrite pgp signature validation. http://hg.code.sf.net:8000/p/roundup/code/#changeset-186956a87ad708b2db41a81991e7c2d692dc1cfd John Rouillard rouilj@ieee.org 2023-05-29T18:42:08-04:00 2023-05-29T18:42:08-04:00
changeset 186956a87ad7
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description issue2551279 - GPG support removed from pypi - rewrite pgp signature validation.

Added/updated documentation on using gpg signature files for the
distribution to security.txt.

Added signature files to main website/mercurial.

Removed verification documentation from public key file included in
distribution. key file now references security.txt/.html.
files
update to use ralf's preferred email address. http://hg.code.sf.net:8000/p/roundup/code/#changeset-a3223f1966fc4bfcecf6d637bcbe69bdc1b9742a John Rouillard rouilj@ieee.org 2022-12-03T09:42:35-05:00 2022-12-03T09:42:35-05:00
changeset a3223f1966fc
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description update to use ralf's preferred email address.
files
merge http://hg.code.sf.net:8000/p/roundup/code/#changeset-ffe29ee47c4728198e40b9f524a9727d4d9a554b John Rouillard rouilj@ieee.org 2022-12-02T22:47:39-05:00 2022-12-02T22:47:39-05:00
changeset ffe29ee47c47
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description merge
files
Add new security.txt http://hg.code.sf.net:8000/p/roundup/code/#changeset-1836e0ef7751861db3df29f1a8bd603ed428f45f John Rouillard rouilj@ieee.org 2022-12-02T22:30:12-05:00 2022-12-02T22:30:12-05:00
changeset 1836e0ef7751
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description Add new security.txt

Add to index, remove security.txt from exclude list in website. Add
:orphan: to security-history.txt since it is only linked from
upgrading.txt.
files
doc: Fix some Sphinx warnings. http://hg.code.sf.net:8000/p/roundup/code/#changeset-8ee41c7372e7eda6c3b76c5f62fdf67fb07b8840 anatoly techtonik techtonik@gmail.com 2013-01-14T17:00:27+03:00 2013-01-14T17:00:27+03:00
changeset 8ee41c7372e7
branch
bookmark
tag
user anatoly techtonik <techtonik@gmail.com>
description doc: Fix some Sphinx warnings.
files
Documentation polishing. http://hg.code.sf.net:8000/p/roundup/code/#changeset-32b24abfe98eb6ba320e0b9e67bacf47d7bee2f0 Eric S. Raymond esr@thyrsus.com 2011-11-15T18:35:54-05:00 2011-11-15T18:35:54-05:00
changeset 32b24abfe98e
branch
bookmark
tag
user Eric S. Raymond <esr@thyrsus.com>
description Documentation polishing.
files
Remove $-cookies that have been misleading since roundup moved off CVS. http://hg.code.sf.net:8000/p/roundup/code/#changeset-33a1f03b9de07ea81c27ae16c0071da69c723103 Eric S. Raymond esr@thyrsus.com 2011-10-31T17:48:11-04:00 2011-10-31T17:48:11-04:00
changeset 33a1f03b9de0
branch
bookmark
tag
user Eric S. Raymond <esr@thyrsus.com>
description Remove $-cookies that have been misleading since roundup moved off CVS.

One of these, a $Date$ cookie, might accidentally expanded correctly by
Subversion *if* keyword expansion was enabled on that file; but judging by
the ancientness of the date, it probably wasn't.

In any case, git doesn't do any keyword expansion at all, so there
isn't an equivalent to translate these into.
files
update http://hg.code.sf.net:8000/p/roundup/code/#changeset-251382399e45a0635c930af5fc8bfcb37b609c6d Richard Jones richard@users.sourceforge.net 2007-11-04T05:12:07+00:00 2007-11-04T05:12:07+00:00
changeset 251382399e45
branch
bookmark
tag 1.4.0
user Richard Jones <richard@users.sourceforge.net>
description update
files
instance -> tracker, node -> item http://hg.code.sf.net:8000/p/roundup/code/#changeset-43ab730ee194eee99f94fd8461c893641dc05b79 Richard Jones richard@users.sourceforge.net 2002-09-10T00:15:59+00:00 2002-09-10T00:15:59+00:00
changeset 43ab730ee194
branch
bookmark
tag
user Richard Jones <richard@users.sourceforge.net>
description instance -> tracker, node -> item
files
documentation reorg post-new-security http://hg.code.sf.net:8000/p/roundup/code/#changeset-299f4890427dc27eb080644a9877f7279c88a815 Richard Jones richard@users.sourceforge.net 2002-07-29T23:30:14+00:00 2002-07-29T23:30:14+00:00
changeset 299f4890427d
branch
bookmark
tag
user Richard Jones <richard@users.sourceforge.net>
description documentation reorg post-new-security
files
documentation updates http://hg.code.sf.net:8000/p/roundup/code/#changeset-38a74d1351c58ebf6d0df6323f24267802899b94 Richard Jones richard@users.sourceforge.net 2002-07-29T00:54:41+00:00 2002-07-29T00:54:41+00:00
changeset 38a74d1351c5
branch
bookmark
tag
user Richard Jones <richard@users.sourceforge.net>
description documentation updates
files
Very close now. The cgi and mailgw now use the new security API. http://hg.code.sf.net:8000/p/roundup/code/#changeset-502a5ae11cc5a505d121a615d604b86dd80018a0 Richard Jones richard@users.sourceforge.net 2002-07-26T08:27:00+00:00 2002-07-26T08:27:00+00:00
changeset 502a5ae11cc5
branch
bookmark
tag
user Richard Jones <richard@users.sourceforge.net>
description Very close now. The cgi and mailgw now use the new security API.

The two templates have been migrated to that setup. Lots of unit
tests. Still some issue in the web form for editing Roles assigned to
users.
files
Bugger it. Here's the current shape of the new security implementation. http://hg.code.sf.net:8000/p/roundup/code/#changeset-b0d3d353599811ad292bd520c5b680ba6d0cc0c7 Richard Jones richard@users.sourceforge.net 2002-07-25T07:14:06+00:00 2002-07-25T07:14:06+00:00
changeset b0d3d3535998
branch
bookmark
tag
user Richard Jones <richard@users.sourceforge.net>
description Bugger it. Here's the current shape of the new security implementation.

Still to do:
. call the security funcs from cgi and mailgw
. change shipped templates to include correct initialisation and remove
the old config vars
... that seems like a lot. The bulk of the work has been done though. Honest :)
files
this could work... http://hg.code.sf.net:8000/p/roundup/code/#changeset-7d41d4dae378dd093e027eaf3fb9fc1af82e7119 Richard Jones richard@users.sourceforge.net 2002-07-17T23:40:19+00:00 2002-07-17T23:40:19+00:00
changeset 7d41d4dae378
branch
bookmark
tag
user Richard Jones <richard@users.sourceforge.net>
description this could work...
files
Getting closer to a good framework. http://hg.code.sf.net:8000/p/roundup/code/#changeset-2ccfd7fa00997d14bb4baf8a9a887bc2a99718e1 Richard Jones richard@users.sourceforge.net 2002-07-17T23:29:34+00:00 2002-07-17T23:29:34+00:00
changeset 2ccfd7fa0099
branch
bookmark
tag
user Richard Jones <richard@users.sourceforge.net>
description Getting closer to a good framework.
files
just some formatting and a minor clarification. http://hg.code.sf.net:8000/p/roundup/code/#changeset-d19dd123bda24d9a1ffc476fb5d238f6e37db74e Richard Jones richard@users.sourceforge.net 2002-07-17T21:44:14+00:00 2002-07-17T21:44:14+00:00
changeset d19dd123bda2
branch
bookmark
tag
user Richard Jones <richard@users.sourceforge.net>
description just some formatting and a minor clarification.
files
More (hopefully final) thoughts. http://hg.code.sf.net:8000/p/roundup/code/#changeset-a4ab8fdf83a226a5ebb2da881a3de39eca06170f Richard Jones richard@users.sourceforge.net 2002-07-15T22:05:17+00:00 2002-07-15T22:05:17+00:00
changeset a4ab8fdf83a2
branch
bookmark
tag
user Richard Jones <richard@users.sourceforge.net>
description More (hopefully final) thoughts.
files
more thoughts... almost there I think http://hg.code.sf.net:8000/p/roundup/code/#changeset-a3de8f9b2ede7a2470e1f1f27cc8e0fe7b09d9a8 Richard Jones richard@users.sourceforge.net 2002-07-15T02:04:57+00:00 2002-07-15T02:04:57+00:00
changeset a3de8f9b2ede
branch
bookmark
tag
user Richard Jones <richard@users.sourceforge.net>
description more thoughts... almost there I think
files
Some refinements http://hg.code.sf.net:8000/p/roundup/code/#changeset-261a71cb7f7fa7ad6b621fec3c7984ef4ab89d35 Richard Jones richard@users.sourceforge.net 2002-07-14T23:16:52+00:00 2002-07-14T23:16:52+00:00
changeset 261a71cb7f7f
branch
bookmark
tag
user Richard Jones <richard@users.sourceforge.net>
description Some refinements
files
Updated documents http://hg.code.sf.net:8000/p/roundup/code/#changeset-e07e5903c3b4cd3d4528146b74cc9ce42971a377 Richard Jones richard@users.sourceforge.net 2002-07-10T00:22:49+00:00 2002-07-10T00:22:49+00:00
changeset e07e5903c3b4
branch
bookmark
tag
user Richard Jones <richard@users.sourceforge.net>
description Updated documents
files
Note correct API calls in the doc ;) http://hg.code.sf.net:8000/p/roundup/code/#changeset-2a0886bacdcc0b8d72f132b6b6ed2abf2106e7c5 Richard Jones richard@users.sourceforge.net 2002-07-08T03:07:37+00:00 2002-07-08T03:07:37+00:00
changeset 2a0886bacdcc
branch
bookmark
tag
user Richard Jones <richard@users.sourceforge.net>
description Note correct API calls in the doc ;)
files
More thoughts http://hg.code.sf.net:8000/p/roundup/code/#changeset-811475894dd9833cdc8fc7132faf3356400d3f42 Richard Jones richard@users.sourceforge.net 2002-06-17T23:15:05+00:00 2002-06-17T23:15:05+00:00
changeset 811475894dd9
branch
bookmark
tag
user Richard Jones <richard@users.sourceforge.net>
description More thoughts
files
Latest thoughts. http://hg.code.sf.net:8000/p/roundup/code/#changeset-d341cd0e76892f7473fcef375a6bc839c46f3563 Richard Jones richard@users.sourceforge.net 2002-05-21T06:04:04+00:00 2002-05-21T06:04:04+00:00
changeset d341cd0e7689
branch
bookmark
tag
user Richard Jones <richard@users.sourceforge.net>
description Latest thoughts.
files
Initial doc holding collated thoughts on roundup security. http://hg.code.sf.net:8000/p/roundup/code/#changeset-2a563dbacd65523ea909bad0589b01cfdc5c65bf Richard Jones richard@users.sourceforge.net 2002-05-17T00:43:42+00:00 2002-05-17T00:43:42+00:00
changeset 2a563dbacd65
branch
bookmark
tag
user Richard Jones <richard@users.sourceforge.net>
description Initial doc holding collated thoughts on roundup security.
files