view doc/html_extra/roundup_short_paper.html @ 8575:b1024bf0d9f7

feature: add nonceless/tokenless CSRF protection Add tokenless CSRF protection following: https://words.filippo.io/csrf/ Must be enabled using use_tokenless_csrf_protection in config.ini. By default it's off. If enabled the older csrf_* settings are ignored. The allowed_api_origins setting is still used for Origin comparisons. This should also improve performance as a nonce isn't required so generating random nonce and saving it to the otks database is eliminated. doc/admin_guide.txt, doc/reference.txt doc/upgrading.txt doc updates. roundup/configuration.py add use_tokenless_csrf_protection setting. move allowed_api_origins directly after use_tokenless_csrf_protection and before the older csrf_* settings. It's used by both of them. Rewrite description of allowed_api_origins as its applied to all URLs with tokenless protection, not just API URLs. roundup/anypy/urllib_.py import urlsplit, it is used in new code. urlparse() is less efficient and splits params out of the path component. Since Roundup doesn't require that params be split from the path. I expect future patch will replace urlparse() with urlsplit() globally and not need urlparse(). roundup/cgi/client.py add handle_csrf_tokenless() and call from handle_csrf() if use_tokenless_csrf_protection is enabled. refactor code that expires csrf tokens when used with the wrong methods (i.e. GET) into expire_exposed_keys(). Call same from handle_csrf and handle_csrf_tokenless. Also improve logging if this happens including both Referer and Origin headers if available. Arguably we dont care about CSRF tokens exposed via GET/HEAD/OPTIONS in the tokenless case, but this cleans them up in case the admin has to switch back. At some future date we can delete all the nonce based CSRF from 2018. Update handle_csrf() docstring about calling/returning handle_csrf_tokenless() when enabled. Call expire_exposed_keys(method) if token is supplied with wrong method. roundup/cgi/templating.py disable nonce generation/save and always return "0" when use_tokenless_csrf_protection enabled.
author John Rouillard <rouilj@ieee.org>
date Sun, 19 Apr 2026 20:50:07 -0400
parents 2ab234484708
children
line wrap: on
line source

<head>
<title>Roundup: A Simple and Effective Issue Tracker in Python</title>
</head>
<body bgcolor="#efefef">
<table bgcolor="#4040a0" width="100%" border=0 cellspacing=0
><tr valign=bottom><td>&nbsp;<br>&nbsp;<br
><font face="helvetica, arial" color="#ffffff"><big><big><strong
>Roundup Short Paper</strong></big></big></font></td><td align=right
><a href="http://www.lfw.org/"
><img src="/images/lfwblue.gif" border=0 width=33 height=22 alt="[LFW]"
></a></td></tr></table>
<h3>Roundup: A Simple and Effective Issue Tracker in Python</h3>
<small><em>Ka-Ping Yee</em>
(<a href="http://www.lfw.org/ping/roundup.html">original site: http://www.lfw.org/ping/roundup.html</a></small>)

<p>Please note that <strong>there is a new, active Roundup project</strong>
led by Richard Jones.  Please <a href="http://roundup.sf.net/">visit them
at SourceForge</a>.

<p>The Roundup prototype is open source.  You can
<a href="roundup.tar.gz"><strong>download it here</strong>
(roundup.tar.gz, 32 kb)</a>.
Or <strong><a href="roundup/roundup.cgi">play with the live prototype!</a>
</strong>
When prompted for authentication, you can use
one of the test accounts: "test", "spam", or "eggs"
(password same as account name).  Roundup's e-mail address is
<a href="mailto:roundup---lfw.org">roundup---lfw.org</a>.  You can't
create new accounts, but you can read the mail spools for
<a href="test.spool">test</a>,
<a href="spam.spool">spam</a>, or
<a href="eggs.spool">eggs</a> here to see what they're getting.


<p><em>A <a href="sc-roundup.html">detailed design proposal
for a more advanced issue-tracking system based on Roundup</a>
has been submitted to
<a href="http://www.software-carpentry.com/">Software Carpentry</a>'s
open source software design competition.</em>  This first-round
submission was 
<a href="http://software-carpentry.codesourcery.com/first-round-results.html"
>selected as a finalist</a>.  A <a href="sc-roundup-2.html">more
detailed implementation guide</a> was submitted to the 
<a href="http://software-carpentry.codesourcery.com/second-round-entries.html"
>second round of the competition</a>.

<p><em>You might also want to check out
<a href="/python/">other Python-related stuff on this site</a>.</em>

<hr>

<p>This short talk will share some experiences from developing and using
the issue tracking system used by my development group at ILM.  It integrates
two modes of access: e-mail for gathering information, and the Web
for search and retrieval.  We currently work with it daily and it
does its job pretty well.

<h4>Fine-Grained Mailing Lists</h4>

<p>The key strength of Roundup is that it generates a small virtual
mailing list for each new issue.  In a way, this is like implementing
private conversation rooms in e-mail.  Although the mechanism is
very simple, the emergent properties are quite effective.  Here's
how it works:

<ol type="a">
<li>New issues are always submitted by sending an e-mail message.
This message is saved in a mail spool attached to the newly-created
issue record, and copied to the relatively large user community of
the application so everyone knows the issue has been raised.

<li>All e-mail messages sent by Roundup have their "Reply-To"
field set to send mail back to Roundup, and have the issue's
ID number in the Subject field.  So, any replies to the
initial announcement and subsequent threads are all received
by Roundup and appended to the spool.

<li>Each issue has a "nosy list" of people interested in the
issue.  Any mail tagged with the issue's ID number is copied
to this list of people, and any users found in the From:,
To:, or Cc: fields of e-mail about the issue are automatically
added to the nosy list.  Whenever a user edits an item in the
Web interface, they are also added to the list.
</ol>

<p>The result is that no one ever has to worry about subscribing to
anything.  Indicating interest in an issue is sufficient, and if you
want to bring someone new into the conversation, all you need to do
is Cc: a message to them.  It turns out that no one ever has to worry
about unsubscribing, either: the nosy lists are so specific in scope
that the conversation tends to die down by itself when the issue is
resolved or people no longer find it sufficiently important.  The
transparent capture of the mail spool attached to each issue also
yields a nice searchable knowledge repository over time.

<h4>User Interface Decisions</h4>

<p>The web interface to Roundup aims to maximize the density of
useful information.  Although this principle is important to all
information presentation, it is especially vital in a web browser
because of the limited window real estate.  Hence Roundup avoids
repetitive or unnecessary information and tries to fit as many
items as possible on the first screen.  For example, Bugzilla
initially displays seven or eight items of the index; Jitterbug can't
even manage to fit any items at all in the first screenful, as it's
taken up by artwork and adminstrative debris.  In contrast, Roundup
shows you about 25 high-priority issues right away.  Colour indicates
the status of each item to help the eye sift through the index quickly.

<p>In both Jitterbug and Bugzilla, items are sorted by default by ID,
a meaningless field.  Sorting by ID puts the issues in order by
ascending submission date, which banishes recent issues as <em>far</em>
away as possible at the bottom of the list.  Roundup sorts items
in sections by priority so the high-priority items are
immediately visible; within sections, items are sorted by date
of last activity.  This reveals at a glance where discussion is
most active, and provides an easy way for anyone to move an issue
up in the list without changing its priority.

<p><hr>
(The following has been added for this web page and was not
part of the short paper in the IPC8 proceedings.)

<h4>Screenshots of the Web Interface</h4>

<p>Here is the <a href="images/roundup-1.png">Roundup index</a>, the first
thing presented to you when you go to Roundup.  Note the use of
colour coding and the attempt to dedicate maximum space to the
description of each issue.

<p>In comparison, here is the <a href="images/jitterbug-1.gif">first
screen you see when you use Jitterbug</a>.  No information is
actually visible!  You have to scroll down to the
<a href="images/jitterbug-2.gif">second screen</a> before you get to
see any bugs, and even then your view is limited to a paltry
eight entries.  The boldface on the item descriptions helps,
but the visual effect of the table is still swamped by the
powerful green header line -- which contains zero bits of
new information.

<p>As another example, Bugzilla presents somewhat more information 
than Jitterbug in its <a href="images/bugzilla-4.gif">index view</a>, but
forces you to go through three
bewildering screens replete with form widgets
(<a href="images/bugzilla-1.gif">one</a>,
<a href="images/bugzilla-2.gif">two</a>,
<a href="images/bugzilla-3.gif">three</a>) before you even get to see
anything.  Examination of the <a href="images/bugzilla-4.gif">index view</a>
shows that one-third to one-half of the screen area (depending how
you count it) is wasted on trivialities or empty space, and the
most important column, the description of each issue,
is shoved off of the right side of the page.

<p><table bgcolor="#4040a0" width="100%" border=0 cellspacing=0
><tr valign=bottom><td
><font face="helvetica, arial" color="#c0c0e0"><small
>copyright &copy; by
<a href="http://www.lfw.org/ping/"
><font color="#c0c0e0">Ka-Ping Yee</font></a>
updated Sun 2 Jul 2000</td><td align=right
><font face="helvetica, arial" color="#c0c0e0"
><small><small>
</small></small></font></td></tr></table>
</body>

Roundup Issue Tracker: http://roundup-tracker.org/