view doc/tracker_templates.txt @ 4880:ca692423e401

Different approach to fix XSS in issue2550817 Encapsulate the error/ok message append method as add_ok_message and add_error_message. The new approach escapes the messages when appending -- at a point in the code where we still know where the message comes from. Escaping is the default but can bei turned off. This also fixes issue2550836 where certain messages may contain links. Another advantage of the new fix is that users don't need to change installed trackers and are secure by default.
author Ralf Schlatterbeck <rsc@runtux.com>
date Mon, 31 Mar 2014 18:19:23 +0200
parents 33a1f03b9de0
children b76be13e027e
line wrap: on
line source

=========================
Roundup Tracker Templates
=========================

The templates distributed with Roundup are stored in the "share" directory
nominated by Python. On Unix this is typically
``/usr/share/roundup/templates/`` (or ``/usr/local/share...``) and
on Windows this is ``c:\python22\share\roundup\templates\``.

The template loading looks in four places to find the templates:

1. *share* - eg. ``<prefix>/share/roundup/templates/*``.
   This should be the standard place to find them when Roundup is
   installed.
2. ``<roundup.admin.__file__>/../templates/*``.
   This will be used if Roundup's run in the distro (aka. source)
   directory.
3. ``<current working dir>/*``.
   This is for when someone unpacks a 3rd-party template.
4. ``<current working dir>``.
   This is for someone who "cd"s to the 3rd-party template dir.

Templates contain:

- modules ``schema.py`` and ``initial_data.py``
- directories ``html``, ``detectors`` and ``extensions``
  (with appropriate contents)
- template "marker" file ``TEMPLATE-INFO.txt``, which contains
  the name of the template, a description of the template
  and its intended audience.

An example TEMPLATE-INFO.txt::

 Name: classic
 Description: This is a generic issue tracker that may be used to track bugs,
              feature requests, project issues or any number of other types
              of issues. Most users of Roundup will find that this template
              suits them, with perhaps a few customisations.
 Intended-For: All first-time Roundup users


Roundup Issue Tracker: http://roundup-tracker.org/