http://hg.code.sf.net:8000/p/roundup/code/atom-log/tip/share/roundup/templates/devel/html/page.html 2026-03-18T17:49:16-04:00 http://hg.code.sf.net:8000/p/roundup/code/#changeset-4184173d364f23d0e319e8c50ed587882416e600 John Rouillard rouilj@ieee.org 2026-03-18T17:49:16-04:00 2026-03-18T17:49:16-04:00

changeset	4184173d364f
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	bug: make web page follow login_empty_passwords setting. remove the required attribute from password input in the the html templates if login_empty_passwords is enabled in config.ini. Also document in upgrading.txt.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-15a92b0a9b792b952da78e9e08d34f7a7f21f61d John Rouillard rouilj@ieee.org 2025-09-25T23:30:07-04:00 2025-09-25T23:30:07-04:00

changeset	15a92b0a9b79
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	fix: make user_src_input generate valid javascript user_src_input used to generate False if edit_ok == False in this statement: tal:attributes="onblur python:edit_ok and 'split_name(this)'; but False isn't a boolean in javascript, so it throws an error in the console. Changed to use: tal:attributes="onblur python:'split_name(this)' if edit_ok else ''; which generates an empty onblur if the field is not editable.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-4ac0bbb3e440678d1f591777ceb5b43e360d3d25 John Rouillard rouilj@ieee.org 2025-07-11T19:30:27-04:00 2025-07-11T19:30:27-04:00

changeset	4ac0bbb3e440
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	bug(security): CVE-2025-53865 - XSS bug Extensive fixes in devel, responsive templates known to be exploitable. Similar constructs in classic and minimal templates not known to be exploitable, but changed anyway. doc/upgrading.txt: Reformat to 66 characters. Update with assigned CVE number. Add section on fixing tal:replace with unsafe data. Document analysis and assumptions in comment in file. doc/security.txt: Update with CVE number.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-2bf0c4e7795e383a6722e70d071361bb3db45b2c John Rouillard rouilj@ieee.org 2025-01-18T12:23:23-05:00 2025-01-18T12:23:23-05:00

changeset	2bf0c4e7795e
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	fix: issue2551390 - Replace text input/calendar popup with native date input Docs, code and test changes for the changeover to a native date element. See issue for details.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-0e382e97f0e311c935908b01eb8b3b16ce0b099e John Rouillard rouilj@ieee.org 2024-07-07T10:49:40-04:00 2024-07-07T10:49:40-04:00

changeset	0e382e97f0e3
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	fix: disable spellchecking for password fields Some browser can send password to a server for spellchecking. This gives the browser a strong hint that they should not spellcheck a password. Since a Password is not supposed to be a real word in any language, spellchecking is worthless.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-a27f30709d4694bd016a01cb14fda3655763f7b6 John Rouillard rouilj@ieee.org 2023-10-26T13:17:52-04:00 2023-10-26T13:17:52-04:00

changeset	a27f30709d46
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	fix: duplicate password id generated for user.item.html Fix the user_confirm_input macro at the end of html/page.html to modify the id so it doesn't duplicate the one used for the regular password.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-d067b089b90b2c36eb6d47da3a9a00fa738876f1 John Rouillard rouilj@ieee.org 2021-07-31T20:37:31-04:00 2021-07-31T20:37:31-04:00

changeset	d067b089b90b
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	Make username/password required in login form On login form, require both password and login name. Neither can be empty. Addeing required to both input field will invoke browser validation (where available) indicating a problem when logging in.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-e2378b6afdb56272dfe71d7bcd447099413ab63b John Rouillard rouilj@ieee.org 2019-04-13T13:53:24-04:00 2019-04-13T13:53:24-04:00

changeset	e2378b6afdb5
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	Fix issue2551041 - change permission check from "Create User" to "Register User" in page.html for the responsive and devel templates. (reporter Cédric Krier)
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-4a157824f9337db137ab7ca1b5bde4234f11c4a7 John Rouillard rouilj@ieee.org 2017-03-18T23:36:02-04:00 2017-03-18T23:36:02-04:00

changeset	4a157824f933
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	changes to try to deploy anti-csrf defense to other templates.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-882fa4d9bead94a5c45b4b8680bd44646f5f5680 John Rouillard rouilj@ieee.org 2016-07-22T15:48:57-04:00 2016-07-22T15:48:57-04:00

changeset	882fa4d9bead
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	issue2550795: @dispname query args in page.html search links not valid html. Some queries with names that include spaces are not properly url encoded/quoted. I.E. a space should be replaced with %20. Fixes to allow a url_query method to be applied to HTMLStringProperty to properly quote string values passed as part of a url.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-602d544e3a93a959e47214a83c5c8cad9dc96e0a John Rouillard rouilj@ieee.org 2016-07-09T13:34:02-04:00 2016-07-09T13:34:02-04:00

changeset	602d544e3a93
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	fixing some mismatched patches/patch references that I borked in a prior checkin. Patch support was not and still is not working. But at least this tracker runs without errors with demo.py -t devel, just missing features.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-ce551200262911921321b08f3bcc0cd0d0020e45 John Rouillard rouilj@ieee.org 2016-07-09T13:07:06-04:00 2016-07-09T13:07:06-04:00

changeset	ce5512002629
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	merge from upstream
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-85eee1f236b2defc1c87c8d02c97414c702512fe John Rouillard rouilj@ieee.org 2016-07-04T18:19:51-04:00 2016-07-04T18:19:51-04:00

changeset	85eee1f236b2
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	I had an incorrect fix for issue2550601. Changed schema to define class patches not patch. Changed commented out patches section in bug.item.html to use patches-1 an not patch-1 as a result of schema changes. The show open Milestones link had a leak of the @group value. If you clicked on show open tasks or show open bugs they group by priority. The url being formed for show open milestones was inheriting the @group if you were on an index page for bugs or milestones. Explicit set the @group to status (which a milestone does have) prevents the @group=priority from being applied to a milestone index page which results in a red error banner stating priority is an invalid param for milestones. ./demo.py -t devel now runs without obvious breakage.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-894aa07be6cbdc4f55634f4d2c11d62232cf0806 John Rouillard rouilj@ieee.org 2016-07-03T12:32:35-04:00 2016-07-03T12:32:35-04:00

changeset	894aa07be6cb
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	issue2550785: Using login from search (or logout) fails. when logging in from a search page or after a logout it fails with an error. The fix also keeps the user on the same page they started from (e.g. search results) before the login. There are two parts to this: 1) changes to the templates to properly define the __came_from form element. 2) code changes to the LoginAction code in roundup/cgi/actions.py. New test code added. Needed some additional functions from urllib so urllib_.py got a change.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-ca692423e401fd0db01f7df02868bd47785bf995 Ralf Schlatterbeck rsc@runtux.com 2014-03-31T18:19:23+02:00 2014-03-31T18:19:23+02:00

changeset	ca692423e401
branch
bookmark
tag
user	Ralf Schlatterbeck <rsc@runtux.com>
description	Different approach to fix XSS in issue2550817 Encapsulate the error/ok message append method as add_ok_message and add_error_message. The new approach escapes the messages when appending -- at a point in the code where we still know where the message comes from. Escaping is the default but can bei turned off. This also fixes issue2550836 where certain messages may contain links. Another advantage of the new fix is that users don't need to change installed trackers and are secure by default.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-24b8011cd2dc29e574d1d83a0a9c71b62d0144a4 Ralf Schlatterbeck rsc@runtux.com 2013-12-20T18:24:10+01:00 2013-12-20T18:24:10+01:00

changeset	24b8011cd2dc
branch
bookmark
tag
user	Ralf Schlatterbeck <rsc@runtux.com>
description	Fix XSS in issue2550817 Note that the code that triggers that particular bug is no longer in roundup core. But the change to the templates we suggest is a *lot* safer as it always escapes the error and ok messages now. If you are upgrading: you *MUST* read doc/upgrading.txt and do the necessary changes to your templates, the escaping now happens in the template and not in the roundup code. So if you don't make the necessary changes *you are vulnerable*.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-9d5825bf0b2d94a699ff1aa96ba5827f1aded6da Ralf Schlatterbeck rsc@runtux.com 2012-05-14T13:04:20+02:00 2012-05-14T13:04:20+02:00

changeset	9d5825bf0b2d
branch
bookmark
tag
user	Ralf Schlatterbeck <rsc@runtux.com>
description	Nicer display of multi-line error messages.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-97b6ff11571b77116010a3c9059690d560420fef Stefan Seefeld stefan@seefeld.name 2011-04-21T15:30:17+00:00 2011-04-21T15:30:17+00:00

changeset	97b6ff11571b
branch
bookmark
tag
user	Stefan Seefeld <stefan@seefeld.name>
description	Fix keyword expression editor for 'devel' tracker template.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-f1fe6fd0aa6120482c4e6a24501777fd7795e9ff Bernhard Reiter Bernhard.Reiter@intevation.de 2010-11-08T16:21:02+00:00 2010-11-08T16:21:02+00:00

changeset	f1fe6fd0aa61
branch
bookmark
tag
user	Bernhard Reiter <Bernhard.Reiter@intevation.de>
description	Multilinks can be filtered by combining elements with AND, OR and NOT now. A javascript gui was added for "keywords", see issue2550648. Developed by Sascha Teichmann; funded by Intevation. (Bernhard Reiter)
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-b419f29b1e2fdeb2aaf2c45644049517e404a444 Stefan Seefeld stefan@seefeld.name 2010-10-12T01:14:07+00:00 2010-10-12T01:14:07+00:00

changeset	b419f29b1e2f
branch
bookmark
tag
user	Stefan Seefeld <stefan@seefeld.name>
description	Add new tracker template.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-e4a166b5ac2d6736e3b7581a1b32e674f4506b20 Stefan Seefeld stefan@seefeld.name 2009-06-17T02:03:19+00:00 2009-06-17T02:03:19+00:00

changeset	e4a166b5ac2d
branch	gsoc-2009
bookmark
tag
user	Stefan Seefeld <stefan@seefeld.name>
description	Fix validity issue.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-115e9883311e2659e6a8029909628daefa297cce Stefan Seefeld stefan@seefeld.name 2009-06-02T00:41:57+00:00 2009-06-02T00:41:57+00:00

changeset	115e9883311e
branch	gsoc-2009
bookmark
tag
user	Stefan Seefeld <stefan@seefeld.name>
description	Add new tracker template sandbox.
files