diff roundup/backends/rdbms_common.py @ 5232:462b0f76fce8

issue2550864 - Potential information leakage via journal/history Fix this by making the hyperdb::Class::history function check for view permissions on the journaled properties. So a user that sees [hidden] for a property in the web interface doesn;t see the property changes in the history. While doing this, relocated the filter for quiet properties from the templating class to the hyperdb. Also added the skipquiet option to the history command in roundup-admin.py to enable filtering of quiet params. Also changed calls to history() in the backend databases to report all items. Changed inline documentation for all history calls that document the actions. The create action (before nov 6 2002) used to record all parameters. After that point the create call uses an empty dictionary. The filtering code depends on the create dictionary being empty. It may not operate properly on very old roundup databases. Changed calls to logging.getLogger to roundup.hyperdb.backends to allow filtering the back end while keeping hyperdb logging. In cgi/templating.py, changed history() function consolidating handiling of link and unlink actions Added tests for quiet property filtering and permission filtering of history.
author John Rouillard <rouilj@ieee.org>
date Fri, 14 Apr 2017 23:24:18 -0400
parents e1e40674a0bc
children 0a20e1965f4b
line wrap: on
line diff
--- a/roundup/backends/rdbms_common.py	Tue Apr 11 22:20:13 2017 -0400
+++ b/roundup/backends/rdbms_common.py	Fri Apr 14 23:24:18 2017 -0400
@@ -533,7 +533,7 @@
         if not self.config.RDBMS_ALLOW_ALTER:
             raise DatabaseError(_('ALTER operation disallowed: %r -> %r.'%(old_spec, new_spec)))
 
-        logger = logging.getLogger('roundup.hyperdb')
+        logger = logging.getLogger('roundup.hyperdb.backend')
         logger.info('update_class %s'%spec.classname)
 
         logger.debug('old_spec %r'%(old_spec,))
@@ -858,7 +858,7 @@
         Note: I don't commit here, which is different behaviour to the
               "nuke from orbit" behaviour in the dbs.
         """
-        logging.getLogger('roundup.hyperdb').info('clear')
+        logging.getLogger('roundup.hyperdb.backend').info('clear')
         for cn in self.classes:
             sql = 'delete from _%s'%cn
             self.sql(sql)
@@ -1194,7 +1194,7 @@
         """Remove a node from the database. Called exclusively by the
            destroy() method on Class.
         """
-        logging.getLogger('roundup.hyperdb').info('destroynode %s%s'%(
+        logging.getLogger('roundup.hyperdb.backend').info('destroynode %s%s'%(
             classname, nodeid))
 
         # make sure the node exists
@@ -1263,9 +1263,14 @@
         """ Journal the Action
         'action' may be:
 
-            'create' or 'set' -- 'params' is a dictionary of property values
+            'set' -- 'params' is a dictionary of property values
+            'create' -- 'params' is an empty dictionary as of
+                      Wed Nov 06 11:38:43 2002 +0000
             'link' or 'unlink' -- 'params' is (classname, nodeid, propname)
-            'retire' -- 'params' is None
+            'retired' or 'restored' -- 'params' is None
+
+            'creator' -- the user performing the action, which defaults to
+            the current user.
         """
         # handle supply of the special journalling parameters (usually
         # supplied on importing an existing database)
@@ -1409,7 +1414,7 @@
     def sql_commit(self, fail_ok=False):
         """ Actually commit to the database.
         """
-        logging.getLogger('roundup.hyperdb').info('commit')
+        logging.getLogger('roundup.hyperdb.backend').info('commit')
 
         self.conn.commit()
 
@@ -1455,7 +1460,7 @@
         Undo all the changes made since the database was opened or the last
         commit() or rollback() was performed.
         """
-        logging.getLogger('roundup.hyperdb').info('rollback')
+        logging.getLogger('roundup.hyperdb.backend').info('rollback')
 
         self.sql_rollback()
 
@@ -1470,7 +1475,7 @@
         self.clearCache()
 
     def sql_close(self):
-        logging.getLogger('roundup.hyperdb').info('close')
+        logging.getLogger('roundup.hyperdb.backend').info('close')
         self.conn.close()
 
     def close(self):
@@ -2955,7 +2960,8 @@
         properties = self.getprops()
         r = []
         for nodeid in self.getnodeids():
-            for nodeid, date, user, action, params in self.history(nodeid):
+            for nodeid, date, user, action, params in self.history(nodeid,
+                            enforceperm=False, skipquiet=False):
                 date = date.get_tuple()
                 if action == 'set':
                     export_data = {}

Roundup Issue Tracker: http://roundup-tracker.org/