http://hg.code.sf.net:8000/p/roundup/code/atom-log/tip/test/test_security.py 2026-04-08T21:39:40-04:00 http://hg.code.sf.net:8000/p/roundup/code/#changeset-9c3ec0a5c7fc88acb8a65632ecc13b2d52380314 John Rouillard rouilj@ieee.org 2026-04-08T21:39:40-04:00 2026-04-08T21:39:40-04:00

changeset	9c3ec0a5c7fc
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	chore: remove __future print_funcion from code. Not needed as of Python 3.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-98011edc6c600d0449277ae75f0fc57433714301 John Rouillard rouilj@ieee.org 2026-03-26T21:46:19-04:00 2026-03-26T21:46:19-04:00

changeset	98011edc6c60
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	refactor: remove duplicate code block Had the same code inside two different if statements. Replaced with 'if X in [ a, b ] ' and only one copy of the code.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-5b1b876054ef2c28956f54c737697636aba7cd64 John Rouillard rouilj@ieee.org 2023-03-12T23:51:03-04:00 2023-03-12T23:51:03-04:00

changeset	5b1b876054ef
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	Add test for misc functions; addl. testing check Password.__str__ method. Verify that passwords with under 1000 rounds get upgraded. test bchr, bord, h64encode and h64decode. Add fuzzing for h64* functions.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-01c1f357363fbf99fc837b2ddc81357adab522d6 John Rouillard rouilj@ieee.org 2023-03-12T22:15:44-04:00 2023-03-12T22:15:44-04:00

changeset	01c1f357363f
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	flake8 fixes Test some unused variables, formatting fixes.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-19db61be18e05724764689b259e6df6ae2e9cba7 John Rouillard rouilj@ieee.org 2023-03-12T22:02:37-04:00 2023-03-12T22:02:37-04:00

changeset	19db61be18e0
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	more tests for password.py Test error conditions for: empty passwords and verify setPassword inherits default scheme pbkdf2(), pbkdf2_sha512(), encodePassword()
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-b124c38930ed8161b34f512345dd76fbd2b1dd46 John Rouillard rouilj@ieee.org 2023-03-12T21:21:18-04:00 2023-03-12T21:21:18-04:00

changeset	b124c38930ed
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	renname test to test_pbkdf2_unpack_errors
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-cbeac604d9d51c6fad42abbbc74f42822e8a8a92 John Rouillard rouilj@ieee.org 2023-03-12T21:19:51-04:00 2023-03-12T21:19:51-04:00

changeset	cbeac604d9d5
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	Test pbkdf2_unpack error conditions
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-8b2287d850c8f5d73aeb27bb499d3d5847bb3740 John Rouillard rouilj@ieee.org 2023-02-26T16:17:37-05:00 2023-02-26T16:17:37-05:00

changeset	8b2287d850c8
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	Fix round check/settings in needs_migration Support test rounds in needs_migration Two test were missing os.environ seting to have them use config setting.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-f6b24a8524cd7bf78e50a891716a39c9c70b3eb4 John Rouillard rouilj@ieee.org 2023-02-25T14:50:34-05:00 2023-02-25T14:50:34-05:00

changeset	f6b24a8524cd
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	Modify code to reduce runtime when testing The prior change to set default number of PBKDF2 rounds to 2000000 (2M) raised runtime in CI from 12 minutes to an hour. This commit checks to see if we are invoked from a pytest test using: if ("pytest" in sys.modules and "PYTEST_CURRENT_TEST" in os.environ): when no config object is present. I assume that the number of times we have a full config object is less than with a missing config object. See if this brings CI runtimes back down. It reduces runtimes on my local box, but.... Code adapted from https://stackoverflow.com/questions/25188119/test-if-code-is-executed-from-within-a-py-test-session/44595269#
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-970cd6d2b8ea21f36c5fa79efc9c298933761445 John Rouillard rouilj@ieee.org 2023-02-23T19:34:39-05:00 2023-02-23T19:34:39-05:00

changeset	970cd6d2b8ea
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	issue2551251 - migrate pbkdf2 passwords if more rounds configured migrate/re-encrypt PBKDF2 password if stored password used a smaller number of rounds than set in password_pbkdf2_default_rounds. Also increase fallback number of rounds (when not set in config) to 2,000,000.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-0b52ee664580fa1ae995da59b0f1c2354249364a John Rouillard rouilj@ieee.org 2023-02-24T00:37:37-05:00 2023-02-24T00:37:37-05:00

changeset	0b52ee664580
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	tests are breaking with last commit. Restore a hopefully working tree while I figure out what's going on
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-cfdcaf8b59360a13e65a493aeab3e954e33e12d3 John Rouillard rouilj@ieee.org 2023-02-23T19:34:39-05:00 2023-02-23T19:34:39-05:00

changeset	cfdcaf8b5936
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	issue2551251 - migrate pbkdf2 passwords if more rounds configured migrate/re-encrypt PBKDF2 password if stored password used a smaller number of rounds than set in password_pbkdf2_default_rounds. Also increase fallback number of rounds (when not set in config) to 2,000,000.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-120b0bb05b6e026f6a7cc2705feff171e37e2ed4 John Rouillard rouilj@ieee.org 2022-03-20T00:05:59-04:00 2022-03-20T00:05:59-04:00

changeset	120b0bb05b6e
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	issue2551191 - Module deprication PEP 594. crypt Handle missing crypt module "better" by raising an exception rather than just silently failing to log in the user when a crypt encoded password can't be checked. Update tests and upgrading.txt too.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-bdcccd2b21413e6897d91c9c72173e8aad9d869e John Rouillard rouilj@ieee.org 2020-09-09T21:37:16-04:00 2020-09-09T21:37:16-04:00

changeset	bdcccd2b2141
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	Replace http:....roundup-tracker.org with https.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-d2805ea1a2c33513c03724cef0245ba839015738 John Rouillard rouilj@ieee.org 2019-06-10T21:48:45-04:00 2019-06-10T21:48:45-04:00

changeset	d2805ea1a2c3
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	replace assertEquals with assertEqual.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-10747e4e4ec4a2e208600e523c5d99e7b66f81db John Rouillard rouilj@ieee.org 2019-06-10T21:28:51-04:00 2019-06-10T21:28:51-04:00

changeset	10747e4e4ec4
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	replace assertNotEquals with assertNotEqual
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-95a366d460654c841c28b1d7d6ba45cda60b1779 John Rouillard rouilj@ieee.org 2019-06-10T21:27:17-04:00 2019-06-10T21:27:17-04:00

changeset	95a366d46065
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	Replace deprecated assertEquals with assertEqual and failUnlessRaises with assertRaises.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-f8893e1cde0d05513a328bd4698dac10d94805b3 John Rouillard rouilj@ieee.org 2019-03-15T20:29:00-04:00 2019-03-15T20:29:00-04:00

changeset	f8893e1cde0d
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	assert_ is depricated. Replacing with assertTrue to reduce logs in travisci.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-d26921b851c328681aa6638475ce2cdae29963b4 Joseph Myers jsm@polyomino.org.uk 2018-07-24T22:22:08+00:00 2018-07-24T22:22:08+00:00

changeset	d26921b851c3
branch
bookmark
tag
user	Joseph Myers <jsm@polyomino.org.uk>
description	Python 3 preparation: make relative imports explicit. Tool-generated patch.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-64b05e24dbd889f52bf8f773d3456bd0135baa27 Joseph Myers jsm@polyomino.org.uk 2018-07-24T09:54:52+00:00 2018-07-24T09:54:52+00:00

changeset	64b05e24dbd8
branch
bookmark
tag
user	Joseph Myers <jsm@polyomino.org.uk>
description	Python 3 preparation: convert print to a function. Tool-assisted patch. It is possible that some "from __future__ import print_function" are not in fact needed, if a file only uses print() with a single string as an argument and so would work fine in Python 2 without that import.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-c94fd717e28c3bcb69e4da83fcbcab9871ad0b60 John Rouillard rouilj@ieee.org 2017-09-19T22:00:20-04:00 2017-09-19T22:00:20-04:00

changeset	c94fd717e28c
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	Fix http://issues.roundup-tracker.org/issue2550952 make __call__ method of a class usable as a check function.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-16a8a3f0772c75fc6291e5bb180e7399600cd908 John Rouillard rouilj@ieee.org 2017-03-18T15:12:39-04:00 2017-03-18T15:12:39-04:00

changeset	16a8a3f0772c
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	Reset state of: self.db.security.set_props_only_default(False) at end of testGetPermission. I thought each test_X module had a fresh environment an load of all modules. I guess that is not the case as not resetting the props_only default to false seemed to bleed into the testAuthFilter in text_xmlrpc.py. However the funny part is it only caused problem in travis ci. Not in my manual running of the full test suite on two platforms. However I am pulling errors because the framework is not skipping the postgres tests for text_xmlrpc. Maybe that failure is hiding something?? If I run just the test_xmlrpc module I would not expect an issue since the security test suite won't be invoked. I am using different versions of the test harness and python so maybe.....
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-e0732fd6a6c7b5d3731b8c0aaa1e30c6a5d72440 rouilj rouilj@uland 2017-03-18T10:44:10-04:00 2017-03-18T10:44:10-04:00

changeset	e0732fd6a6c7
branch
bookmark
tag
user	rouilj@uland
description	Implement props_only feature for permissions.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-36630a062fb52319590caf4c663382d3fbe56fc6 John Rouillard rouilj@ieee.org 2017-02-17T21:18:34-05:00 2017-02-17T21:18:34-05:00

changeset	36630a062fb5
branch
bookmark
tag
user	John Rouillard <rouilj@ieee.org>
description	Check in enhanced form for check command used by addPermission. New form can include a **context dictionary that allows access to the name of the property, class, and permission being checked. This should make designing more complex permission requirements easier.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-364c549918613cff81c3ebe07aee4025e0ef3fcc John Kristensen john@jerrykan.com 2015-08-21T13:08:02+10:00 2015-08-21T13:08:02+10:00

changeset	364c54991861
branch
bookmark
tag
user	John Kristensen <john@jerrykan.com>
description	Remove unneeded TestSuite code from tests The TestSuite code is no longer needed now that we are using py.test which can automatically discover tests
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-63c79c0992aeb805fbed74a82881d2eb32bbb70d John Kristensen john@jerrykan.com 2015-08-20T14:44:49+10:00 2015-08-20T14:44:49+10:00

changeset	63c79c0992ae
branch
bookmark
tag
user	John Kristensen <john@jerrykan.com>
description	Update tests to work with py.test py.test searches for any class that looks like a TestCase in the test directory and tries to run them as tests. Some of the classes that inherit TestCase are not meant to be run and are only intended to be "helper classes". Only the tests of the classes that inherit the "helper classes" should be run. If we convert these "helper classes" to be "mixins" py.test should not pick them up.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-6e3e4f24c75376f61ae0bf0e9ee334567585c38e Eric S. Raymond esr@thyrsus.com 2011-11-16T09:51:38-05:00 2011-11-16T09:51:38-05:00

changeset	6e3e4f24c753
branch
bookmark
tag
user	Eric S. Raymond <esr@thyrsus.com>
description	Remove keyword expansions from CVS. All regression tests passed afterwards.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-1613754d26466c96b3fbf6a74ae5db2f944df1c9 Ralf Schlatterbeck schlatterbeck@users.sourceforge.net 2011-04-14T12:24:59+00:00 2011-04-14T12:24:59+00:00

changeset	1613754d2646
branch
bookmark
tag
user	Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
description	Fix first part of Password handling security issue2550688 (thanks Joseph Myers for reporting and Eli Collins for fixing) Small change against original patch: We still accept plaintext passwords (in known_schemes) when parsing encrypted password (e.g. from database). This way existing databases with plaintext passwords continue to work (I don't know of any, this would need patching on the users side) and all regression tests pass.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-8137456a86f311fcde4d1160b8bfbfe3204cfd35 Ralf Schlatterbeck schlatterbeck@users.sourceforge.net 2010-10-21T08:59:43+00:00 2010-10-21T08:59:43+00:00

changeset	8137456a86f3
branch
bookmark
tag
user	Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
description	more fixes to search permissions: - require that for links and multilinks the searching user has access to at least the orderprop, labelprop, and ID of the linked class - allow combinations of roles: we previosly required that for transitive properties all elements where searchable by the same role. We now allow that the roles can be different for each property. This allows assigning different roles to different sub-systems and allowing users having all required roles to search across subsystems. - regression test updated - fix doc/upgrading example for new signature of roleHasSearchPermission
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-222efa59ee6ca68b0a4f1e3c0b4ef966a4e28677 Ralf Schlatterbeck schlatterbeck@users.sourceforge.net 2010-10-20T08:58:52+00:00 2010-10-20T08:58:52+00:00

changeset	222efa59ee6c
branch
bookmark
tag
user	Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
description	search permissions must allow transitive properties
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-75dc225613ccf1f0352945831607c9dfaaf516fb Richard Jones richard@users.sourceforge.net 2006-02-03T04:04:37+00:00 2006-02-03T04:04:37+00:00

changeset	75dc225613cc
branch
bookmark
tag
user	Richard Jones <richard@users.sourceforge.net>
description	fix security check for hasPermission(Permission, None) add hasRole to HTMLUser
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-ac1803a09920fc669d690db64633dacc5484d9a3 Richard Jones richard@users.sourceforge.net 2005-01-28T04:10:22+00:00 2005-01-28T04:10:22+00:00

changeset	ac1803a09920
branch	maint-0.8
bookmark
tag
user	Richard Jones <richard@users.sourceforge.net>
description	far more merging from HEAD than is good
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-c26f2ba69c78cee811b3d36666e1ef6136756846 Richard Jones richard@users.sourceforge.net 2005-01-28T04:07:58+00:00 2005-01-28T04:07:58+00:00

changeset	c26f2ba69c78
branch
bookmark
tag
user	Richard Jones <richard@users.sourceforge.net>
description	some bits I missed, and the next release will be beta ;)
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-460eb0209a9e4557bf770ab1bd73908c12199842 Richard Jones richard@users.sourceforge.net 2005-01-28T03:51:19+00:00 2005-01-28T03:51:19+00:00

changeset	460eb0209a9e
branch
bookmark
tag
user	Richard Jones <richard@users.sourceforge.net>
description	Permissions improvements. - have Permissions only test the check function if itemid is suppled - modify index templates to check for row-level Permission - more documentation of security mechanisms - better unit tests for security mechanisms
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-79f91a6dbc7f0d6fc52edf708571326c6347243a Alexander Smishlajev a1s@users.sourceforge.net 2004-11-18T15:54:09+00:00 2004-11-18T15:54:09+00:00

changeset	79f91a6dbc7f
branch
bookmark
tag
user	Alexander Smishlajev <a1s@users.sourceforge.net>
description	use new backends interface; fix vim modeline
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-f63aa57386b0b2c50eb311d6b407a12e9b5e45db Richard Jones richard@users.sourceforge.net 2003-10-25T22:53:26+00:00 2003-10-25T22:53:26+00:00

changeset	f63aa57386b0
branch
bookmark
tag
user	Richard Jones <richard@users.sourceforge.net>
description	Backend improvements. - using Zope3's test runner now, allowing GC checks, nicer controls and coverage analysis - all RDMBS backends now have indexes on several columns - added testing of schema mutation, fixed rdbms backends handling of a couple of cases - !BETA! added postgresql backend, needs work !BETA!
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-bd3b57859c377a10dc064bd3ee698e27f3aa45e9 Richard Jones richard@users.sourceforge.net 2002-09-20T05:08:00+00:00 2002-09-20T05:08:00+00:00

changeset	bd3b57859c37
branch
bookmark
tag
user	Richard Jones <richard@users.sourceforge.net>
description	On second thought, that last checkin was dumb. The old, nasty, for-purely-historical-reasons journaltag-as-username has gone away now. The code should handle existing journaltag-as-username entries, but will use userid from now on.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-9b910e8d987d9c68848931f69cc57243f04e6dee Richard Jones richard@users.sourceforge.net 2002-09-10T00:19:55+00:00 2002-09-10T00:19:55+00:00

changeset	9b910e8d987d
branch
bookmark
tag
user	Richard Jones <richard@users.sourceforge.net>
description	removed Log
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-ef9c759c243e9b097a06449387096b366c9d18e1 Richard Jones richard@users.sourceforge.net 2002-07-29T21:53:29+00:00 2002-07-29T21:53:29+00:00

changeset	ef9c759c243e
branch
bookmark
tag
user	Richard Jones <richard@users.sourceforge.net>
description	Fix to hasPermission, thanks Stefan Seefeld.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-502a5ae11cc5a505d121a615d604b86dd80018a0 Richard Jones richard@users.sourceforge.net 2002-07-26T08:27:00+00:00 2002-07-26T08:27:00+00:00

changeset	502a5ae11cc5
branch
bookmark
tag
user	Richard Jones <richard@users.sourceforge.net>
description	Very close now. The cgi and mailgw now use the new security API. The two templates have been migrated to that setup. Lots of unit tests. Still some issue in the web form for editing Roles assigned to users.
files

http://hg.code.sf.net:8000/p/roundup/code/#changeset-b0d3d353599811ad292bd520c5b680ba6d0cc0c7 Richard Jones richard@users.sourceforge.net 2002-07-25T07:14:06+00:00 2002-07-25T07:14:06+00:00

changeset	b0d3d3535998
branch
bookmark
tag
user	Richard Jones <richard@users.sourceforge.net>
description	Bugger it. Here's the current shape of the new security implementation. Still to do: . call the security funcs from cgi and mailgw . change shipped templates to include correct initialisation and remove the old config vars ... that seems like a lot. The bulk of the work has been done though. Honest :)
files