http://hg.code.sf.net:8000/p/roundup/code/atom-log/tip/share/roundup/templates/classic/schema.py 2024-12-21T15:23:12-05:00 http://hg.code.sf.net:8000/p/roundup/code/#changeset-984bc9f94ec65be4ec22a729442c0204b4d9988f John Rouillard rouilj@ieee.org 2024-12-21T15:23:12-05:00 2024-12-21T15:23:12-05:00

changeset	984bc9f94ec6
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	chore: format schema.pys in templates so ruff is ok. Also makes comparing them easier.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-c087ad45bf4d52ebbeab6a7eb105104e1962a2d3 John Rouillard rouilj@ieee.org 2023-02-02T12:55:27-05:00 2023-02-02T12:55:27-05:00

changeset	c087ad45bf4d
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	update Anonymous Create user to Register user permissions the devel and responsive tracker templates still had the old Create user permissions for the anonymous user. Replace with the Regiter permission that has been the standard since 1.4.11 maybe. Also update references to Create permission in comment for the Email Access permission for anon user.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-94a7669677ae229ff639da90a98eee7f0392b171 John Rouillard rouilj@ieee.org 2019-09-27T23:29:59-04:00 2019-09-27T23:29:59-04:00

changeset	94a7669677ae
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	add permissions to control user of rest and xmlrpc API interfaces. issue2551058: Add new permissions: 'Rest Access' and 'Xmlrpc Access' to allow per-user access control to rest and xmlrpc interfaces using roles. Updated all schemas to add these new perms to all authenticated roles. Error conditions in handle_xmlrpc were not working right in manual testing. I tried to make it a little better, but I don't actually understand how the fault xmlrpc object is supposed to be used. So I may have messed something up. I'll try to ping the people who wrote the xmlrpc code to have them review.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-1c90f15a177f91e2d5d5882358ea2076e3900338 John Rouillard rouilj@ieee.org 2016-07-03T14:20:48-04:00 2016-07-03T14:20:48-04:00

changeset	1c90f15a177f
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	issue2550831: Make the classic template query.edit page work. Forgot to update the classic schema.py with the Restore permissions for the query class for the User role. Also forgot to document same in upgrading.txt.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-cf112b90fa8ddf5f715ed556955de718c36f34a1 John Rouillard rouilj@ieee.org 2016-06-30T21:08:15-04:00 2016-06-30T21:08:15-04:00

changeset	cf112b90fa8d
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	issue2550855: added search perms for anonymous to the user class. This lets the "show unassigned" search work for anonymous. Patch by Stuart McGraw. Added warning to upgrading.txt and a comment block before the schema change in every template tracker except minimal (doesn't have the search).
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-a403c29ffaf90efc510e09aad06afeba9780d844 Ralf Schlatterbeck rsc@runtux.com 2014-07-04T15:32:28+02:00 2014-07-04T15:32:28+02:00

changeset	a403c29ffaf9
branch
bookmark
tag
user	Ralf Schlatterbeck <rsc@runtux.com>
description	Security fix default user permissions Default user permissions should not include all user attributes. We now limit this to the username, realname and some further attributes depending on the schema. Note that we no longer include the email addresses, depending on your installation you may want to further restrict this or add some attributes like ``address`` and ``alternate_addresses``.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-261c9f913ff78c2f2c0b2beacef42f761b6c2488 Ralf Schlatterbeck schlatterbeck@users.sourceforge.net 2010-10-19T15:29:05+00:00 2010-10-19T15:29:05+00:00

changeset	261c9f913ff7
branch
bookmark
tag
user	Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
description	- Add explicit "Search" permissions, see Security Fix below. - Security Fix: Add a check for search-permissions: now we allow searching for properties only if the property is readable without a check method or if an explicit search permission (see above unter "Features) is given for the property. This fixes cases where a user doesn't have access to a property but can deduce the content by crafting a clever search, group or sort query. see doc/upgrading.txt for how to fix your trackers!
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-b30bdfae44611d039899e17c1107163c7fa829ac Richard Jones richard@users.sourceforge.net 2009-12-20T23:24:21+00:00 2009-12-20T23:24:21+00:00

changeset	b30bdfae4461
branch
bookmark
tag
user	Richard Jones <richard@users.sourceforge.net>
description	Fix security hole allowing user permission escalation (thanks Ralf Schlatterbeck) also update docs and prepare for a release
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-42331c201b024cab413e373606c934033afc8191 Stefan Seefeld stefan@seefeld.name 2009-06-30T01:41:11+00:00 2009-06-30T01:41:11+00:00

changeset	42331c201b02
branch
bookmark
tag
user	Stefan Seefeld <stefan@seefeld.name>
description	Fix issue2550553.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-34434785f308e2f73cb3007312fb221c2cfd3d5e Richard Jones richard@users.sourceforge.net 2009-03-12T02:25:03+00:00 2009-03-12T02:25:03+00:00

changeset	34434785f308
branch
bookmark
tag
user	Richard Jones <richard@users.sourceforge.net>
description	Plug a number of security holes: - EditCSV and ExportCSV altered to include permission checks - HTTP POST required on actions which alter data - HTML file uploads served as application/octet-stream - New item action reject creation of new users - Item retirement was not being controlled Additionally include documentation of the changes and modify affected tests.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-a6fdaaa3a8bd81128c87bb5aebc97bc13b44db1f Stefan Seefeld stefan@seefeld.name 2009-02-23T15:31:29+00:00 2009-02-23T15:31:29+00:00

changeset	a6fdaaa3a8bd
branch
bookmark
tag
user	Stefan Seefeld <stefan@seefeld.name>
description	Move templates/ to share/roundup/templates/
files