http://hg.code.sf.net:8000/p/roundup/code/atom-log/tip/share/roundup/templates/devel/html/bug.item.html 2025-07-11T19:30:27-04:00 http://hg.code.sf.net:8000/p/roundup/code/#changeset-4ac0bbb3e440678d1f591777ceb5b43e360d3d25 John Rouillard rouilj@ieee.org 2025-07-11T19:30:27-04:00 2025-07-11T19:30:27-04:00

changeset	4ac0bbb3e440
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	bug(security): CVE-2025-53865 - XSS bug Extensive fixes in devel, responsive templates known to be exploitable. Similar constructs in classic and minimal templates not known to be exploitable, but changed anyway. doc/upgrading.txt: Reformat to 66 characters. Update with assigned CVE number. Add section on fixing tal:replace with unsafe data. Document analysis and assumptions in comment in file. doc/security.txt: Update with CVE number.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-abf1297e7a940f7bbe42fed4e319d9de96cdc740 John Rouillard rouilj@ieee.org 2025-07-08T13:38:08-04:00 2025-07-08T13:38:08-04:00

changeset	abf1297e7a94
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	bug(security): fix XSS exploit in devel and responsive templates Replace all occurances of: tal:content="structure context/MUMBLE/plain" with tal:content="context/MUMBLE/plain" This seems to have been an old way to handle display of a field when the user did not have edit rights. It does not occur in current (later than 2009) classic tracker templates. But probably was unsed in earlier classic templates since devel, reponsive and the roundup issue tracker templates were based on classic. Add CVE placeholder to security.txt and link to fix directions added to upgrading.txt. Add note in announcement.txt and CHANGES.txt Add a details element around the table of contents in the upgrading guide. It was getting long. Updated a missed XSS issue in the roundup tracker template. Live site is already fixed. XSS bug reported by 4bug of ChaMd5 Security Team H1 Group
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-d0460348bf9ab95652d3cae9763a4300505f6b5a John Rouillard rouilj@ieee.org 2024-12-21T16:35:11-05:00 2024-12-21T16:35:11-05:00

changeset	d0460348bf9a
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	fix: issue2550924. clean up schema for devel/responsive templates. both templates have the same schema. Changes patches class to patch in devel schema. Change bug.issue.html to account for patches -> patch rename. Sort property list for a permission. Add patch class for responsive template. From both remove incorrect comment.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-602d544e3a93a959e47214a83c5c8cad9dc96e0a John Rouillard rouilj@ieee.org 2016-07-09T13:34:02-04:00 2016-07-09T13:34:02-04:00

changeset	602d544e3a93
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	fixing some mismatched patches/patch references that I borked in a prior checkin. Patch support was not and still is not working. But at least this tracker runs without errors with demo.py -t devel, just missing features.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-ce551200262911921321b08f3bcc0cd0d0020e45 John Rouillard rouilj@ieee.org 2016-07-09T13:07:06-04:00 2016-07-09T13:07:06-04:00

changeset	ce5512002629
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	merge from upstream
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-85eee1f236b2defc1c87c8d02c97414c702512fe John Rouillard rouilj@ieee.org 2016-07-04T18:19:51-04:00 2016-07-04T18:19:51-04:00

changeset	85eee1f236b2
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	I had an incorrect fix for issue2550601. Changed schema to define class patches not patch. Changed commented out patches section in bug.item.html to use patches-1 an not patch-1 as a result of schema changes. The show open Milestones link had a leak of the @group value. If you clicked on show open tasks or show open bugs they group by priority. The url being formed for show open milestones was inheriting the @group if you were on an index page for bugs or milestones. Explicit set the @group to status (which a milestone does have) prevents the @group=priority from being applied to a milestone index page which results in a red error banner stating priority is an invalid param for milestones. ./demo.py -t devel now runs without obvious breakage.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-821a3d789b40418263efb365f5cc8783a08a72c4 Stefan Seefeld stefan@seefeld.name 2010-11-04T21:29:06+00:00 2010-11-04T21:29:06+00:00

changeset	821a3d789b40
branch
bookmark
tag
user	Stefan Seefeld <stefan@seefeld.name>
description	Fix small typos.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-b419f29b1e2fdeb2aaf2c45644049517e404a444 Stefan Seefeld stefan@seefeld.name 2010-10-12T01:14:07+00:00 2010-10-12T01:14:07+00:00

changeset	b419f29b1e2f
branch
bookmark
tag
user	Stefan Seefeld <stefan@seefeld.name>
description	Add new tracker template.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-c3e3e00932a049618b3576f59a44162f21556547 Pygi pygi@users.sourceforge.net 2009-08-15T07:43:11+00:00 2009-08-15T07:43:11+00:00

changeset	c3e3e00932a0
branch	gsoc-2009
bookmark
tag
user	Pygi <pygi@users.sourceforge.net>
description	Added patch stuff support
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-115e9883311e2659e6a8029909628daefa297cce Stefan Seefeld stefan@seefeld.name 2009-06-02T00:41:57+00:00 2009-06-02T00:41:57+00:00

changeset	115e9883311e
branch	gsoc-2009
bookmark
tag
user	Stefan Seefeld <stefan@seefeld.name>
description	Add new tracker template sandbox.
files