Mercurial > p > roundup > code
view website/issues/detectors/statusauditor.py @ 8062:28aa76443f58
fix(security): fix CVE-2024-39124, CVE-2024-39124, and CVE-2024-39125
Directions for fixing:
* `CVE-2024-39124`_ - :ref:`classhelpers (_generic.help.html) are
vulnerable to an XSS attack. <CVE-2024-39124>` Requires fixing
tracker homes.
* `CVE-2024-39125`_ - :ref:`if Referer header is set to a script
tag, it will be executed. <CVE-2024-39125>` Fixed in release 2.4.0,
directions available for fixing in prior versions.
* `CVE-2024-39126`_ - :ref:`PDF, XML and SVG files downloaded from
an issue can contain embedded JavaScript which is
executed. <CVE-2024-39126>` Fixed in release 2.4.0, directions
available for fixing in prior versions.
prior to 2.4.0 release this weekend that fixes the last two CVE's.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Tue, 09 Jul 2024 09:07:09 -0400 |
| parents | 13e8f188f8dd |
| children |
line wrap: on
line source
def preset_new(db, cl, nodeid, newvalues): """ Make sure the status is set on new issues""" if 'status' in newvalues and newvalues['status']: return new = db.status.lookup('new') newvalues['status'] = new def update_pending(db, cl, nodeid, newvalues): ''' If the issue is currently 'pending' and person other than assigned updates it, then set it to 'open'. ''' # don't fire if there's no new message (ie. update) if 'messages' not in newvalues: return if newvalues['messages'] == cl.get(nodeid, 'messages'): return # get the open state ID try: open_id = db.status.lookup('open') except KeyError: # no open state, ignore all this stuff return # get the current value current_status = cl.get(nodeid, 'status') # see if there's an explicit change in this transaction if 'status' in newvalues: # yep, skip return assignee = cl.get(nodeid, 'assignee') if assignee == db.getuid(): # this change is brought to you by the assignee and number 4 # so don't change status. return # determine the id of 'pending' fromstates = [] for state in 'pending'.split(): try: fromstates.append(db.status.lookup(state)) except KeyError: pass # ok, there's no explicit change, so check if we are in a state that # should be changed if current_status in fromstates + [None]: # yep, we're now open newvalues['status'] = open_id def init(db): # fire before changes are made db.issue.audit('create', preset_new) db.issue.audit('set', update_pending)
