Mercurial > p > roundup > code

view website/issues/html/page.html @ 8357:abf1297e7a94

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
bug(security): fix XSS exploit in devel and responsive templates Replace all occurances of: tal:content="structure context/MUMBLE/plain" with tal:content="context/MUMBLE/plain" This seems to have been an old way to handle display of a field when the user did not have edit rights. It does not occur in current (later than 2009) classic tracker templates. But probably was unsed in earlier classic templates since devel, reponsive and the roundup issue tracker templates were based on classic. Add CVE placeholder to security.txt and link to fix directions added to upgrading.txt. Add note in announcement.txt and CHANGES.txt Add a details element around the table of contents in the upgrading guide. It was getting long. Updated a missed XSS issue in the roundup tracker template. Live site is already fixed. XSS bug reported by 4bug of ChaMd5 Security Team H1 Group
author John Rouillard <rouilj@ieee.org>
date Tue, 08 Jul 2025 13:38:08 -0400
parents 394f72021dad
children 001c16ac87ec
line wrap: on
line source

<tal:block metal:define-macro="icing">
<!DOCTYPE html>
<html lang="en">
<head>
<meta tal:attributes="charset request/client/charset" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title metal:define-slot="head_title">title goes here</title>
<link media="screen" href="@@file/defaultfonts.css" type="text/css" rel="alternate stylesheet" title="default fonts" />
<meta name="description" content="Tracker for bugs and enhancements to the Roundup Issue Tracker software (https://www.roundup-tracker.org/). Yes, we eat our own dog food." />
<link rel="stylesheet" type="text/css" href="@@file/style.css" />
<script tal:attributes="nonce request/client/client_nonce"
	tal:replace="structure request/base_javascript">
</script>
<metal:x define-slot="more-javascript" />

<link rel="alternate" type="application/rss+xml"
  tal:attributes="href string:${request/base}@@file/rss.xml"
  title="Publicly available tracker feed.">
</head>
<body
tal:define="
kw_create python:request.user.hasPermission('Create', 'keyword');
columns string:id,activity,title,creator,status;
columns_showall string:id,activity,title,creator,assignee,status;
status_notresolved string:-1,1,2,4;
">
  <div class="header">
    <h1><a href="/">Roundup Tracker - Issues</a></h1>
<div id="searchbox">
    <form name="searchform" method="get" action="issue" id="searchform">
      <div id="search">
       <input type="hidden" name="@columns"
              tal:attributes="value columns_showall"/>
       <input type="hidden" name="@sort" value="-activity" />
       <input type="hidden" name="@group" value="priority" />
       <input type="hidden" name="@filter" value="status"/>
       <input type="hidden" name="status" tal:attributes="value status_notresolved"/>
       <input class="input-text" aria-label="type in search term" id="search-text" name="@search_text" size="10" />
<input type="submit" id="submit" value="search in open issues" name="submit"
       class="input-button"/>
      </div>
     </form>
</div> <!-- searchbox -->
  </div>
  <div class="navigation">
  <div class="menu">
  <ul>
    <li><a href="https://www.roundup-tracker.org" title="home...">Home</a></li>
    <li><a href="https://pypi.python.org/pypi/roundup" title="Get it !">Download</a></li>
    <li><a href="https://www.roundup-tracker.org/docs.html" title="What you always wanted to know...">Docs</a></li>
    <li class="current"><a href="/" i18n:translate="">Issues</a>
     <ul tal:condition="python:request.user.hasPermission('View', 'issue')">
         <li tal:condition="python:request.user.hasPermission('Create', 'issue')">
          <a href="issue?@template=item" i18n:translate="">Create New</a>
         </li>
         <li><a href="#"
                tal:attributes="href python:request.indexargs_url('issue', {
                                '@sort': '-activity',
                                '@group': 'priority',
                                '@filter': 'status',
                                '@columns': columns_showall,
                                '@search_text': '',
                                'status': status_notresolved,
                                '@dispname': i18n.gettext('Show All'),
                                '@startwith': 0,
                                })"
                i18n:translate="">Show Open</a></li>
         <li><a href="#"
                tal:attributes="href python:request.indexargs_url('issue', {
                                '@sort': '-activity',
                                '@group': 'priority',
                                '@filter': 'status,assignee',
                                '@columns': columns,
                                '@search_text': '',
                                'status': status_notresolved,
                                'assignee': '-1',
                                '@dispname': i18n.gettext('Show Unassigned'),
                                '@startwith': 0,
                                })"
                i18n:translate="">Show Unassigned</a></li>
         <li>
           <a href="issue?@template=search&status=1" i18n:translate="">Search</a>
         </li>
         <li>
           <form method="post" tal:attributes="action request/base">
             <input type="submit" class="form-small" value="Show issue:"
                    i18n:attributes="value"/>
             <input class="form-small" size="4"
		    aria-label="Type in issue number"
                    type="text" name="@number"/>
             <input type="hidden" name="@type" value="issue"/>
             <input type="hidden" name="@action" value="show"/>
	     <input name="@csrf" type="hidden"
		    tal:attributes="value python:utils.anti_csrf_nonce()">
           </form>
         </li>
       </ul>

   <ul>
     <li tal:condition="python:request.user.username=='anonymous'" class="submenu">
      <b i18n:translate="">User</b>
     <form method="post" tal:attributes="action request/base">
       <ul>
      <li>
       <label for="__login" i18n:translate="">Login</label><br/>
       <input size="10" id="__login" name="__login_name"/><br/>
       <input size="10" type="password"
	      aria-label="Password field for login"
	      name="__login_password"/><br/>
       <input type="hidden" name="@action" value="Login"/>
       <input type="checkbox" name="remember" id="remember"/>
       <label for="remember" i18n:translate="">Remember me?</label><br/>
       <input class="form-small" type="submit" value="Login" i18n:attributes="value"/><br/>
   <input name="@csrf" type="hidden"
      tal:attributes="value python:utils.anti_csrf_nonce()">
  <input type="hidden" name="__came_from"
    tal:condition="exists:request/env/QUERY_STRING"
    tal:attributes="value string:${request/base}${request/env/PATH_INFO}?${request/env/QUERY_STRING}">
  <input type="hidden" name="__came_from"
    tal:condition="not:exists:request/env/QUERY_STRING"
    tal:attributes="value string:${request/base}${request/env/PATH_INFO}">
       <span tal:replace="structure request/indexargs_form" />
       </li>
       <li>
       <a href="user?@template=register"
          tal:condition="python:request.user.hasPermission('Register', 'user')"
          i18n:translate="">Register</a>
	</li>
       <li><a href="user?@template=forgotten" i18n:translate="">Lost&nbsp;your&nbsp;login?</a>
       </li>
       </ul>
      </form>
     </li>

     <li tal:condition="python:request.user.username != 'anonymous'" class="submenu">
   <p class="label"><b tal:replace="python:request.user.username.plain(escape=1)">username</b></p>
    <ul>
    <li>
    <a href="#"
       tal:attributes="href python:request.indexargs_url('issue', {
      '@sort': '-activity',
      '@group': 'priority',
      '@filter': 'status,assignee',
      '@columns': 'id,activity,title,creator,status',
      '@search_text': '',
      'status': status_notresolved,
      'assignee': request.user.id,
      '@dispname': i18n.gettext('Your Issues'),
      '@startwith': 0,
     })"
    i18n:translate="">Your Issues</a>
    </li>
    <li>
       <a tal:attributes="href string:user${request/user/id}"
          i18n:translate="">Your Details</a>
    </li>
    <li>
       <a tal:attributes="href python:request.indexargs_url('',
          {'@action':'logout'})" i18n:translate="">Logout</a>
    </li>
     <li class=""
         tal:condition="python:request.user.hasPermission('View', 'query')">
   <span i18n:translate=""><b>Your Queries</b> (<a class="nomargin" href="query?@template=edit">edit</a>)</span><br/>
   <ul tal:repeat="qs request/user/queries">
    <li><a href="#" tal:attributes="href string:${qs/klass}?${qs/url}&@dispname=${qs/name/url_quote}"
       tal:content="qs/name">link</a></li>
   </ul>
     </li>
     <li class=""
         tal:condition="python:request.user.hasPermission('View', 'user')">
   <b i18n:translate="">Administration</b>
   <ul>
   <li tal:condition="python:request.user.hasPermission('Edit', None)">
    <a href="home?@template=classlist" i18n:translate="">Class List</a>
   </li>
   <li tal:condition="python:request.user.hasPermission('View', 'user')
                            or request.user.hasPermission('Edit', 'user')">
    <a href="user?@sort=username"  i18n:translate="">User List</a>
   </li>
   <li tal:condition="python:request.user.hasPermission('Create', 'user')"><a href="user?@template=item" i18n:translate="">Add User</a>
   </li>
   <li tal:condition="python:request.user.hasPermission('Edit',
 'keyword')"><a href="keyword" i18n:translate="">Edit Keywords</a>
   </li>
<!--   <li tal:condition="python:request.user.hasPermission('SB: May Classify',None)"><a href="msg?@sort=-spambayes_score">View Spam</a>
   </li>-->
   </ul>
     </li>
    </ul>
   </li>
  </ul>

     </li>
    <li><a href="https://www.roundup-tracker.org/contact.html" title="Get in touch.">Contact</a></li>
    <li><a href="https://wiki.roundup-tracker.org" title="Share your ideas...">Wiki</a></li>
    <li><a href="https://www.roundup-tracker.org/code.html" title="Be the sources with you.">Code</a></li>
  </ul>
 </div> <!-- menu -->
</div> <!-- navigation -->

<div class="content">
<h1 id="breadcrumb"><span metal:define-slot="body_title">body title</span></h1>
 <p tal:condition="options/error_message | nothing" class="error-message"
    tal:repeat="m options/error_message"
    tal:content="structure string:$m <br/ > " />
 <p tal:condition="options/ok_message | nothing" class="ok-message">
  <span tal:repeat="m options/ok_message"
        tal:content="structure string:$m <br/ > " />
  <a class="form-small" tal:attributes="href request/current_url"
     i18n:translate="">clear this message</a>
 </p>
 <tal:block metal:define-slot="content">Page content goes here</tal:block>
</div> <!-- content -->
<div class="footer">
<div id="credits">
  <p>
    Hosted on <a href="https://m.do.co/c/783434964889" title="Hosted on DigitalOcean">DigitalOcean</a>,
    <br>
    Supported by <a href="https://www.python.org/psf-landing/" title="The Python Software Foundation">The Python Software Foundation</a>,
    <br>
    Powered by <a href="https://roundup.sourceforge.io" title="Powered by the Roundup Issue Tracker">Roundup</a>
  </p>
</div> <!-- credits -->
<!-- Created: Wed Jan 14 11:55:38 EST 2009 -->
<!-- hhmts start -->
Last modified: Fri Feb 28 22:02:04 EST 2020
<!-- hhmts end -->
</div> <!-- footer -->

<pre tal:condition="request/form/deissue | nothing" tal:content="request">
</pre>

</body>
</html>
</tal:block>

<!--
The following macros are intended to be used in search pages.

The invoking context must define a "name" variable which names the
property being searched.

See issue.search.html in the classic template for examples.
-->

<!-- creates a th and a label: -->
<th metal:define-macro="th_label"
    tal:define="required required | python:[]"
    tal:attributes="class python:(name in required) and 'required' or nothing">
  <label tal:attributes="for name" tal:content="label" i18n:translate="">text</label>
	<metal:x define-slot="behind_the_label" />
</th>

<td metal:define-macro="search_input">
  <input tal:attributes="value python:request.form.getvalue(name) or nothing;
                         name name;
                         id name"/>
</td>

<td metal:define-macro="search_date">
  <input tal:attributes="value python:request.form.getvalue(name) or nothing;
                         name name;
                         id name"/>
  <a class="classhelp"
	 tal:attributes="href python:'''javascript:help_window('issue?@template=calendar&property=%s&form=itemSynopsis', 300, 200)'''%name">(cal)</a>
</td>

<td metal:define-macro="search_popup">
  <!--
    context needs to specify the popup "columns" as a comma-separated
    string (eg. "id,title" or "id,name,description") as well as name
  -->
  <input tal:attributes="value python:request.form.getvalue(name) or nothing;
                         name name;
                         id name"/>
  <span tal:replace="structure python:db.issue.classhelp(columns,
                                      property=name)" />
</td>

<td metal:define-macro="search_select">
  <select tal:attributes="name name; id name"
          tal:define="value python:request.form.getvalue(name)">
    <option value="" i18n:translate="">don't care</option>
    <metal:slot define-slot="extra_options" />
    <option value="" i18n:translate="" disabled="disabled">------------</option>
    <option tal:repeat="s python:db[db_klass].list()"
            tal:attributes="value s/id; selected python:value == s.id"
            tal:content="python:s[db_content]"></option>
  </select>
</td>

<!-- like search_select, but translates the further values.
Could extend it (METAL 1.1 attribute "extend-macro")
-->
<td metal:define-macro="search_select_translated">
  <select tal:attributes="name name; id name"
          tal:define="value python:request.form.getvalue(name)">
    <option value="" i18n:translate="">don't care</option>
    <metal:slot define-slot="extra_options" />
    <option value="" i18n:translate="" disabled="disabled">------------</option>
    <option tal:repeat="s python:db[db_klass].list()"
            tal:attributes="value s/id; selected python:value == s.id"
						tal:content="python:s[db_content]"
						i18n:translate=""></option>
  </select>
</td>

<!-- currently, there is no convenient API to get a list of all roles -->
<td metal:define-macro="search_select_roles"
	  tal:define="onchange onchange | nothing">
  <select name=roles id=roles tal:attributes="onchange onchange">
    <option value="" i18n:translate="">don't care</option>
    <option value="" i18n:translate="" disabled="disabled">------------</option>
    <option value="User">User</option>
    <option value="Developer">Developer</option>
    <option value="Coordinator">Coordinator</option>
  </select>
</td>

<td metal:define-macro="search_multiselect">
  <input tal:attributes="value python:request.form.getvalue(name) or nothing;
                         name name;
                         id name"/>
  <span tal:replace="structure python:db[db_klass].classhelp(db_content,
                                        property=name, width='600')" />
</td>

<td metal:define-macro="search_checkboxes">
 <ul class="search-checkboxes"
     tal:define="value python:request.form.getvalue(name);
                 values python:value and value.split(',') or []">
 <li tal:repeat="s python:db[db_klass].list()">
  <input type="checkbox" tal:attributes="name name; id string:$name-${s/id};
    value s/id; checked python:s.id in values" />
  <label tal:attributes="for string:$name-${s/id}"
         tal:content="python:s[db_content]" />
 </li>
 <li metal:define-slot="no_value_item">
  <input type="checkbox" value="-1" tal:attributes="name name;
     id string:$name--1; checked python:value == '-1'" />
  <label tal:attributes="for string:$name--1" i18n:translate="">no value</label>
 </li>
 </ul>
</td>

<td metal:define-macro="column_input">
  <input type="checkbox" name="@columns"
         tal:attributes="value name;
                         checked python:name in cols"/>
</td>

<td metal:define-macro="sort_input">
  <input type="radio" name="@sort"
         tal:attributes="value name;
                         checked python:name == sort_on"/>
</td>

<td metal:define-macro="group_input">
  <input type="radio" name="@group"
         tal:attributes="value name;
                         checked python:name == group_on"/>
</td>

<!--
The following macros are intended for user editing.

The invoking context must define a "name" variable which names the
property being searched; the "edit_ok" variable tells whether the
current user is allowed to edit.

See user.item.html in the classic template for examples.
-->
<script metal:define-macro="user_utils" type="text/javascript"
	src="@@file/user_utils.js"
	tal:attributes="nonce request/client/client_nonce"></script>

<!-- src: value will be re-used for other input fields -->
<input metal:define-macro="user_src_input"
    type="text" tal:attributes="onblur python:edit_ok and 'split_name(this)';
    id name; name name; value value; readonly not:edit_ok"
    value="heinz.kunz"/>
<!-- normal: no re-using -->
<input metal:define-macro="user_normal_input" type="text"
    tal:attributes="id name; name name; value value; readonly not:edit_ok"
    value="heinz"/>
<!-- password: type; no initial value -->
    <input metal:define-macro="user_pw_input" type="password"
    tal:attributes="id name; name name; readonly not:edit_ok" value=""/>
    <input metal:define-macro="user_confirm_input" type="password"
    tal:attributes="id name; name string:@confirm@$name; readonly not:edit_ok" value=""/>
Roundup Issue Tracker: http://roundup-tracker.org/