Mercurial > p > roundup > code
view doc/acknowledgements.txt @ 8411:ef1ea918b07a reauth-confirm_id
feat(security): Add user confirmation/reauth for sensitive changes
Auditors can raise Reauth(reason) exception to require the user to
enter a token (e.g. account password) to verify the user is performing
the change.
Naming is subject to change.
actions.py: New ReauthAction class handler and verifyPassword() method
for overriding if needed.
client.py: Handle Reauth exception by calling Client:reauth() method.
Default client:reauth method. Add 'reauth' action declaration.
exceptions.py: Define and document Reauth exception as a subclass of
RoundupCGIException.
templating.py: Define method utils.embed_form_fields().
The original form making a change to the database has a lot of form
fields. These need to be resubmitted to Roundup as part of the form
submission that verifies the user's password.
This method turns all non file form fields into type=hidden inputs.
It escapes the names and values to prevent XSS.
For file form fields, it base64 encodes the contents and puts them
in hidden pre blocks. The pre blocks have data attributes for the
filename, filetype and the original field name. (Note the original
field name is not used.)
This stops the file content data (maybe binary e.g. jpegs) from
breaking the html page. The reauth template runs JavaScript that
turns the encoded data inside the pre tags back into a file. Then
it adds a multiple file input control to the page and attaches all
the files to it. This file input is submitted with the rest of the
fields.
_generic.reauth.html (multiple tracker templates): Generates a form
with id=reauth_form to:
display any message from the Reauth exception to the user (e.g. why
user is asked to auth).
get the user's password
submit the form
embed all the form data that triggered the reauth
recreate any file data that was submitted as part of the form and
generate a new file input to push the data to the back end
It has the JavaScript routine (as an IIFE) that regenerates a file
input without user intervention.
All the TAL based tracker templates use the same form. There is also
one for the jinja2 template. The JavaScript for both is the same.
reference.txt: document embed_form_fields utility method.
upgrading.txt: initial upgrading docs.
TODO:
Finalize naming. I am leaning toward ConfirmID rather than Reauth.
Still looking for a standard name for this workflow.
Externalize the javascript in _generic.reauth.html to a seperate file
and use utils.readfile() to embed it or change the script to load it
from a @@file url.
Clean up upgrading.txt with just steps to implement and less feature
detail/internals.
Document internals/troubleshooting in reference.txt.
Add tests using live server.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Mon, 11 Aug 2025 14:01:12 -0400 |
| parents | 1482729ba16d |
| children |
line wrap: on
line source
.. meta:: :description: Display contributions of code and documentation to the Roundup Issue Tracker. Includes users who reported issues. Updated for each release. Acknowledgements ================ The Roundup Initative is a group of people that regularly work together to produce new releases of the Roundup Issue Tracker. We like to thank our community and all organisation and people that support us doing so with code, money, time, testing, reports, ideas and everything else that helped! `Announcement with changelog for current release.`_ .. _`Announcement with changelog for current release.`: announcement.html 2.5 --- 2.5.0 ~~~~~ Maintainer: John Rouillard Release Manager: John Rouillard Developer activity by changesets:: rouilj@ieee.org 222 ***************************************************** rsc@runtux.com 27 ****** Other contributers: Christof Meerwald - reported issue 2551387 Ludwig Reiter - reported issue 2551074 Marcus Priesch - patch for issue 2551287 Paul Schwabauer - updates to gpg python module so it still works for Roundup. Randy - reported issue 2551396 Tobias Herp - patch for issue 1895197 4bug of ChaMd5 Security Team H1 Group - XSS vulnerability report 2.4 --- 2.4.0 ~~~~~ Maintainer: John Rouillard Release Manager: John Rouillard Developer activity by changesets:: rouilj@ieee.org 532 ************************** rsc@runtux.com 2 Marcus Preisch 1 Norbert Schlemmer "Noschvie on github.com" 1 Other contributers: Norbert Schlemmer - docker support Bharath Kanama, Nikunj Thakkar, Patel Malav - classhelper web component development. Alec Romano (4rdr) - identified multiple security issues 2.3 --- 2.3.0 ~~~~~ Maintainer: John Rouillard Release Manager: John Rouillard Developer activity by changesets:: rouilj@ieee.org 722 **************************************************** rsc@runtux.com 14 * Other contributers Marcus Priesch, John Kristensen (jerrykan), Thomas Arendsen Hein, Gabor Nagy 2.2 --- 2.2.0 ~~~~~ Maintainer: John Rouillard, Ralf Schlatterbeck Release Manager: John Rouillard Developer activity by changesets:: rouilj@ieee.org 291 ************************************************ rsc@runtux.com 11 ** aburke 1 cmeerw@cmeerw.org 1 thomas@intevation.de 1 Other contributers Marcus Priesch, John Kristensen (jerrykan), Ashely Burke, Nagy Gabor, Norbert Schlemmer, Thomas Arendsen Hein 2.1 --- 2.1.0 ~~~~~ Maintainer: John Rouillard, Ralf Schlatterbeck Release Manager: John Rouillard Developer activity by changesets:: rouilj at ieee.org 178 *************************************************** rsc at runtux.com 29 ******** cedric.krier at b2ck.com 6 ** cmeerw at cmeerw.org 1 john at jerrykan.com 1 Tobias Herp 1 2.0 --- 2.0.0 ~~~~~ Maintainer: Ralf Schlatterbeck, John Rouillard Release Manager: John Rouillard Developer activity by changesets:: rouilj at ieee.org 62 *************************************************** rsc at runtux.com 11 ********* cmeerw at cmeerw.org 4 *** 2.0.0b0 ~~~~~~~ Maintainer: Ralf Schlatterbeck, John Rouillard Release Manager: John Rouillard Developer activity by changesets:: rouilj at ieee.org 133 ************************************************ cmeerw at cmeerw.org 35 ************* rsc at runtux.com 10 **** jsm at polyomino.org.uk 1 2.0.0a0 ~~~~~~~ Maintainer: Ralf Schlatterbeck, John Rouillard Release Manager: John Rouillard Developer activity by changesets:: rouilj@ieee.org 13674 *************************************************************************************** jsm@polyomino.org.uk 4746 ****************************** cmeerw@cmeerw.org 3622 *********************** dangchau1991@yahoo.com 3374 ********************* rsc@runtux.com 2871 ****************** ezio.melotti@gmail.com 103 * john@jerrykan.com 40 bernhard@intevation.de 29 martin.v.loewis 8 cedric.krier@b2ck.com 6 tekberg@uw.edu 6 gabriele.roeger@unibas.ch 4 Other contributers Chau Nguyen, Andreas (anrounham14), Robert Klonner, Garth Jensen 1.6 --- 1.6.1 ~~~~~ Maintainer: Ralf Schlatterbeck, John Rouillard Release Manager: John Rouillard Developer activity by changesets:: rouilj at ieee.org 19 ********************************************* bernhard at intevation.de 1 ** jsm at polyomino.org.uk 1 ** Joseph Myers, Cédric Krier, hannob/JulienPalard 1.6.0 ~~~~~ Maintainer: Ralf Schlatterbeck, John Rouillard Release Manager: John Rouillard Developer activity by changesets:: rouilj at ieee.org 234 ********************************************** rsc at runtux.com 30 ****** john at jerrykan.com 26 ***** bernhard at intevation.de 10 ** esr at thyrsus.com 8 ** techtonik at gmail.com 5 * dangchau1991 at gmail.com 1 pf at artcom-gmbh.de 1 thomas at intevation.de 1 Frank Niessink, Anthony (antmail), Bruce Tulloch, kinggreedy, David Wolever, Tom Ekberg, Peter Funk, Daniel Diniz, W. Trevor King, Igor Ippolitov, Joseph Myers, r.david.murray, martin.v.loewis, Henry (henryl), David Wolever, Stuart McGraw (smcgraw), Philipp Gortan (mephinet), Ezio Melotti, Heiko Stegmann, Trent Gamblin, Anton Schur 1.5 --- 1.5.1 ~~~~~ Maintainer: Ralf Schlatterbeck Release Manager: Anatoly Techtonik Developer activity by changesets:: hg churn -c --rev 1.5.0:1.5.1 techtonik@gmail.com 98 ********************************************** bernhard@intevation.de 44 ********************* Bernhard Reiter rsc@runtux.com 37 ***************** Ralf Schlatterbeck john@jerrykan.com 26 ************ John Kristensen thomas@intevation.de 22 ********** Thomas Arendsen Hein rouilj@ieee.org 5 ** John P. Rouillard caulagi@gmail.com 2 * Pradip Caulagi ced@b2ck.com 1 Cédric Krier Mathias Behrle, Ezio Melotti, R David Murray, James Mack, Thibault Fevry, Kai Storbeck, Kay Hayen, Karl-Philipp Richter 1.5.0 ~~~~~ Maintainer: Ralf Schlatterbeck:: hg churn -c --rev 1.4.21:1.5.0 techtonik@gmail.com 37 ********************************************** Anatoly Techtonik bernhard@intevation.de 17 ********************* Bernhard Reiter caulagi@gmail.com 16 ******************** Pradip Caulagi rouilj@ieee.org 8 ********** John P. Rouillard rsc@runtux.com 6 ******* Ralf Schlatterbeck thomas@intevation.de 5 ****** Thomas Arendsen Hein Tom Ekberg, Erik Hanspers pre 1.5.0 --------- Go Ping, you rock! Also, go Common Ground, ekit.com and Bizar Software for letting me implement this system on their time. Thanks also to the many people on the mailing list, in the sourceforge project and those who just report bugs: Christian Aastorp, Thomas Arendsen Hein, Nerijus Baliunas, Benni Bärmann, Anthony Baxter, David Benjamin, Marlon van den Berg, Bo Berglund, Olly Betts, Stéphane Bidoul, Rafal Bisingier, Cameron Blackwood, Jeff Blaine, Duncan Booth, Seb Brezel, J Alan Brogan, Titus Brown, Steve Byan, Brett Cannon, Godefroid Chapelle, Pradip Caulagi, Eli Collins, Roch'e Compaan, Wil Cooley, Joe Cooper, Kelley Dagley, Bruno Damour, Bradley Dean, Toby Dickenson, Paul F. Dubois, Hauke Duden, Eric Earnst, Peter Eisentraut, Andrew Eland, Jeff Epler, Tom Epperly, Tamer Fahmy, Thibault Févry, Vickenty Fesunov, Hernan Martinez Foffani, Trent Gamblin, Stuart D. Gathman, Martin Geisler, Ajit George, Dirk Geschke, Frank Gibbons, Johannes Gijsbers, Christian Glass, Gus Gollings, Philipp Gortan, Dan Grassi, Robin Green, Jason Grout, Charles Groves, Engelbert Gruber, Bruce Guenter, Tamás Gulácsi, Satchidanand Haridas, Sebastian Harl, Ralf Hemmecke, Juergen Hermann, Tobias Herp, Uwe Hoffmann, Alex Holkner, Tobias Hunger, Werner Hunger, Simon Hyde, Paul Jimenez, Christophe Kalt, Timo Kankare, Brian Kelley, James Kew, Sheila King, Michael Klatt, Bastian Kleineidam, Robert Klonner, Axel Kollmorgen, Cédric Krier, John Kristensen, Detlef Lannert, Andrey Lebedev, Henrik Levkowetz, David Linke, Martin v. Löwis, Fredrik Lundh, Jochen Maes, Will Maier, Ksenia Marasanova, Georges Martin, Gordon McMillan, Christof Meerwald, John F Meinel Jr, Roland Meister, Ezio Melotti, Ulrik Mikaelsson, John Mitchell, Ramiro Morales, Toni Mueller, Joseph Myers, Chau Nguyen, Stefan Niederhauser, Truls E. Næss, Bryce L Nordgren, Patrick Ohly, "om", Luke Opperman, Anthony Pankov, Eddie Parker, Will Partain, Timo Paulssen, Benjamin Pollack, Peter Pöml, Ewout Prangsma, Marcus Priesch, Eric S. Raymond, Bernhard Reiter, Roy Rapoport, John P. Rouillard, Luke Ross, Jesse Ruderman, Ollie Rutherfurd, Toby Sargeant, Giuseppe Scelsi, Ralf Schlatterbeck, Gregor Schmid, Florian Schulze, Klamer Schutte, Dougal Scott, Stefan Seefeld, Jouni K Seppänen, Jeffrey P Shell, Dan Shidlovsky, Joel Shprentz, Terrel Shumway, Emil Sit, Alexander Smishlajev, Nathaniel Smith, Leonardo Soto, Maciej Starzyk, Heiko Stegmann, Kai Storbeck, Mitchell Surface, anatoly techtonik, Jon C. Thomason, Mike Thompson, Hubert Touvet, Michael Twomey, Joseph E. Trent, Karl Ulbrich, Martin Uzak, Darryl VanDorp, J Vickroy, Timothy J. Warren, Jakub Wilk, William (Wilk), Tue Wennerberg, Matt Wilbert, Chris Withers, David Wolever, Cheer Xiao, Milan Zamazal.