view doc/debugging.txt @ 6375:c4371ec7d1c0

Call verifyPassword even if user does not exist. Address timing attack caused by not doing the password check if the user doesn't exist. Can expose valid usernames. Really only useful for a tracker that doesn't allow anonymous access to issues. Issues usually show usernames as part of the message display.
author John Rouillard <rouilj@ieee.org>
date Tue, 06 Apr 2021 22:51:55 -0400
parents a635a60ffb84
children
line wrap: on
line source

Debugging Aids
--------------

Try turning on logging of DEBUG level messages. This may be done a number
of ways, depending on what it is you're testing:

1. If you're testing the database unit tests, then set the environment
   variable ``LOGGING_LEVEL=DEBUG``. This may be done like so:

    LOGGING_LEVEL=DEBUG python -m pytest test/

   This variable replaces the older HYPERDBDEBUG environment var.

2. If you're testing a particular tracker, then set the logging level in
   your tracker's ``config.ini``.

SENDMAILDEBUG
=============

Set to a filename and roundup will write each email message
that it sends to that file instead to the internet. 
This environment variable is independent of the python -O flag.


Roundup Issue Tracker: http://roundup-tracker.org/