Mercurial > p > roundup > code
diff CHANGES.txt @ 5232:462b0f76fce8
issue2550864 - Potential information leakage via journal/history
Fix this by making the hyperdb::Class::history function check for view
permissions on the journaled properties. So a user that sees [hidden]
for a property in the web interface doesn;t see the property changes
in the history.
While doing this, relocated the filter for quiet properties
from the templating class to the hyperdb.
Also added the skipquiet option to the history command in
roundup-admin.py to enable filtering of quiet params.
Also changed calls to history() in the backend databases to report all
items.
Changed inline documentation for all history calls that document the
actions. The create action (before nov 6 2002) used to record all
parameters. After that point the create call uses an empty dictionary.
The filtering code depends on the create dictionary being empty.
It may not operate properly on very old roundup databases.
Changed calls to logging.getLogger to roundup.hyperdb.backends to
allow filtering the back end while keeping hyperdb logging.
In cgi/templating.py, changed history() function consolidating
handiling of link and unlink actions
Added tests for quiet property filtering and permission filtering
of history.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Fri, 14 Apr 2017 23:24:18 -0400 |
| parents | 8743b7226dc7 |
| children | 092c4522b3bf |
line wrap: on
line diff
--- a/CHANGES.txt Tue Apr 11 22:20:13 2017 -0400 +++ b/CHANGES.txt Fri Apr 14 23:24:18 2017 -0400 @@ -105,7 +105,12 @@ prop.quiet=True support for anydb backend, added tests, doc updates, support for ignoring quiet setting using showall=True in call to history() - function in templates by John Rouillard. + function in templates by (John Rouillard). (Note implementation + changed while implementing fix for issue2550864. Filtering of + quiet properties pushed down to the hyperdb.py::Class::history + function. This fixes a small bug in the implementation that caused + a limiting the templating history call to display fewer than the + the requested number of items if some were quiet.) - issue2550767: Add newitemcopy.py detector to notify users of new items. Added to detectors directory and a README.txt generated to describe the purpose of the directory. It also says the detectors @@ -196,6 +201,12 @@ genconfig but it uses values from an existing config.ini rather than default values. Use to update an existing config.ini with new options and help text. (John Rouillard) +- issue2550864: Potential information leakage via journal/history + Hyperdb history function now only returns properties that the user + has View permissions on. Can be overridden by setting a parameter + when calling the method. Also restructured code that implemented + issue1714899 moving it from the templating class to the hyperdb. + (John Rouillard) Fixed: