view website/issues/html/_generic.index.html @ 6375:c4371ec7d1c0

Call verifyPassword even if user does not exist. Address timing attack caused by not doing the password check if the user doesn't exist. Can expose valid usernames. Really only useful for a tracker that doesn't allow anonymous access to issues. Issues usually show usernames as part of the message display.
author John Rouillard <rouilj@ieee.org>
date Tue, 06 Apr 2021 22:51:55 -0400
parents 447a7647f237
children
line wrap: on
line source

<!-- dollarId: issue.index,v 1.2 2001/07/29 04:07:37 richard Exp dollar-->

<tal:block metal:use-macro="templates/page/macros/icing">
<title metal:fill-slot="head_title" i18n:translate=""
 ><span tal:replace="python:context._classname.capitalize()"
 i18n:name="class" /> editing - <span i18n:name="tracker"
 tal:replace="config/TRACKER_NAME" /></title>
<tal:block metal:fill-slot="body_title" i18n:translate=""
 ><span tal:replace="python:context._classname.capitalize()"
 i18n:name="class" /> editing</tal:block>

<td class="content" metal:fill-slot="content">

<span tal:condition="python:not (context.is_view_ok() or context.is_edit_ok()
 or request.user.hasRole('Anonymous'))"
 tal:omit-tag="python:1" i18n:translate=""
>You are not allowed to view this page.</span>

<span tal:condition="python:not (context.is_view_ok() or context.is_edit_ok())
 and request.user.hasRole('Anonymous')"
 tal:omit-tag="python:1" i18n:translate=""
>Please login with your username and password.</span>

<tal:block tal:condition="context/is_edit_ok">
<tal:block i18n:translate="">
<p class="form-help">
 You may edit the contents of the
 <span tal:replace="request/classname" i18n:name="classname"/>
 class using this form. Commas, newlines and double quotes (") must be
 handled delicately. You may include commas and newlines by enclosing the
 values in double-quotes ("). Double quotes themselves must be quoted by
 doubling ("").
</p>

<p class="form-help">
 Multilink properties have their multiple values colon (":") separated
 (... ,"one:two:three", ...)
</p>

<p class="form-help">
 Remove entries by deleting their line. Add new entries by appending
 them to the table - put an X in the id column. If you wish to restore a
 removed item and you know its id then just put that id in the id column.
</p>
</tal:block>
<form onSubmit="return submit_once()" method="POST"
      tal:attributes="action context/designator">
<textarea rows="15" style="width:90%" name="rows" tal:content="context/csv"></textarea>
<br>
<input name="@csrf" type="hidden"
       tal:attributes="value python:utils.anti_csrf_nonce()">
<input type="hidden" name="@action" value="editCSV">
<input type="submit" value="Edit Items" i18n:attributes="value">
</form>
</tal:block>

<table tal:condition="context/is_only_view_ok" width="100%" class="list">
 <tr>
  <th tal:repeat="property context/propnames" tal:content="property">&nbsp;</th>
 </tr>
 <tal:block repeat="item context/list">
 <tr tal:condition="item/is_view_ok"
     tal:attributes="class python:['normal', 'alt'][repeat['item'].index%6//3]">
  <td tal:repeat="property context/propnames"
   tal:content="python: item[property] or default"
  >&nbsp;</td>
 </tr>
 </tal:block>
</table>

</td>

</tal:block>

Roundup Issue Tracker: http://roundup-tracker.org/