• last updated 3 hours ago
Constraints
Constraints: committers
 
Constraints: files
Constraints: dates
"An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can remove its sandboxing"

See e.g. https://cloud.google.com/blog/products/data-analytics/iframe-sandbox-tutorial

We set in xooauth/tcl/lti-procs.tcl a restrictive default (all sandboxing restrictions are applied by default). Users should relax it according to their embedded application.

xooauth/www/admin/lti-test.tcl is not really a productive file, so we set the already hardcoded value to no-sandboxing and note that this would be appropriate.

    • -7
    • +8
    ./packages/xooauth/www/admin/lti-test.tcl
Remove duplicated entry

download-archive reform

File-Storage used to generate downloaded archives in tgz format, to then switch to zip, more user-friendly, in particular outside the Linux world (See https://openacs.org/forums/message-view?message_id=557561). To ease the transition, a couple of parameters and relative API were introduced that would allow to choose the preferred command one should use. During this reform however, default parameter values in the tcl code became inconsistent with those in the info file. Furthermore, the chosen defaults were set as absolute paths to the executable, which is not friendly to non-linux environments, or other scenarios where the "typical" Linux filesystem structure cannot be assumed (e.g. containers, MacOS...).

The only usage of this parameters/api was in fact in the download-archive vuh. In upstream codebase, no package references this file, not even the file-storage itself. Upon review, one could see that the file would also allow to specify a custom download filename via the path, which could be considered questionable. It would also execute the command in a way that once again assumes some form of Linux environment (e.g. invoking bash).

Save for the ability to customize the archive format and the anti-feature of being able to manipulate the archive filename via the path, the script largely relplicates www/download-zip, in a better shape after a few reforms hinted by e.g. penetration tools.

Given the aformentioned considerations, I have decided to make download-archive a simple redirect to download-zip. Specifying the object_id via the path will keep working, while URLs out there expecting the name to change will not fail, but the name will not be modified. The archive format will from now on be assumed to be zip.

    • -4
    • +2
    ./packages/file-storage/file-storage.info
removed legacy code from apm_transfer_file

util::http::get should be everywhere available

    • -57
    • +3
    ./packages/acs-tcl/tcl/apm-file-procs.tcl
Rework of util::which

The new version deals now correctly with absolute paths,

where just the extensions are added, and it is checked

whether the program is executable.

Extended regression test to deal with optional and required

external dependencies. Missing optional external programs

produce warnings.

    • -30
    • +46
    ./packages/acs-tcl/tcl/utilities-procs.tcl
    • -31
    • +91
    ./packages/acs-tcl/tcl/test/acs-tcl-test-procs.tcl
Reduced redundancy

call text_templates::create_pdf_from_html from

text_templates::create_pdf_content instead of replicating logic

    • -31
    • +27
    ./packages/acs-tcl/tcl/pdf-procs.tcl
Use for new installation relative path names for external programs per default

removed code, which was commented out since ages.

Cleanup of external binaries: always use "util::which" to resolve binaries

    • -3
    • +3
    ./packages/xotcl-request-monitor/www/index.tcl
deprecate unused command cr_check_orphaned_files

reduced number of external dependencies

fixed typo

Improved consistency with external programs

Since "unzip" is used as well on various other places,

use it as well in the file storage. This means that

the parameter "UnzipBinary" for the file-storage package

is now obsolete.

    • -1
    • +0
    ./packages/file-storage/file-storage.info
    • -2
    • +2
    ./packages/file-storage/www/file-add.tcl
Cleanup of external binaries: always use "util::which" to resolve binaries

Background: it is important to always use the same binaries of some

programs. This is important for security reasons, consistency, and

configurability (some operating systems have read-only file systems,

which might be on the path and should be avoided for some operations).

Cleanup of external binaries: always use "util::which" to resolve binaries

Background: it is important to always use the same binaries of some

programs. This is important for security reasons, consistency, and

configurability (some operating systems have read-only file systems,

which might be on the path and should be avoided for some operations).

    • -1
    • +1
    ./packages/acs-admin/tcl/acs-admin-procs.tcl
    • -2
    • +2
    ./packages/acs-tcl/tcl/http-client-procs.tcl

Use GNU grep when available

GNU grep is now used for the lookup of message keys using the

"--include=" parameter. This improves the speed of the command

significantly and reduces the number of external dependencies (no

"find", or "xargs" needed).

    • -8
    • +9
    ./packages/acs-tcl/tcl/00-icanuse-procs.tcl
Removed obsolete files www/admin/lookups-include.tcl

The file www/admin/lookups-include.tcl was replaced some time ago by

www/admin/message-usage-include.tcl but as it looks, not removed from

the repository.

Cleanup of external binaries: always use "util::which" to resolve binaries

    • -3
    • +3
    ./packages/acs-tcl/tcl/apm-file-procs.tcl
Cleanup of external binaries: always use "util::which" to resolve binaries

Furthermore, this change makes the handling of "identify" consistent

with "convert". Before, the parameter "ImageMagickIdentifyBinary"

could not be modified via the parameter settings, only

"ImageMagickConvertBinary" was defined.

Bump version number to 5.10.1b3 to pick up additional parameter.

Improve test:

whether the html filter will accept or not a script tag is configuration-dependent. We now enforce that the outcome is consistent with the security check for HTML used in the filter itself.

Fix method signature

    • -1
    • +1
    ./packages/xotcl-core/tcl/01-debug-procs.tcl
Flush the whole key pattern, now that the key can end either in true or false

Fixes locale__test_lang_conn_browser_locale automated test

    • -2
    • +2
    ./packages/acs-lang/tcl/locale-procs.tcl
Manually replace the ":" entity to prevent attempts at disguising "javascript:" links

    • -1
    • +17
    ./packages/acs-tcl/tcl/text-html-procs.tcl
Replicate injection attempt by penetration tools

Fixed unreviewed commit, which might lead to hard-to-spot errors

The last change assumed that "nls_language" can be hard-wired to

contain most 5 characters. While this not backed by the OpenACS data

model, the standard (RFC 5646) explicitly states that there is no

upper limit on the size of language tags. The tree letter language

codes have been standard since 2001 (RFC 4646).

The change accepts now all defined locales. When the specified locale

is not enabled, it provides a log notice, when the locale is not

defined at all, it provides a warning and falls back to "en_US".

    • -10
    • +19
    ./packages/acs-lang/tcl/locale-procs.tcl
    • -2
    • +17
    ./packages/xowiki/tcl/xowiki-form-procs.tcl
page filters with NUL value

Prefer "string first" over "regexp" since this is twice as fast.

Fixed implementation of value checker dbtext

The old version was not persistent in the blueprints.

Furthermore, the new version is more than 2x faster by

avoiding regular expressions.

    • -8
    • +9
    ./packages/xotcl-core/tcl/01-debug-procs.tcl
bootstrap5 theme: prettify appearance for "ad_form -mode display"

The previous change was already a big improvement. The change makes

it easier to distinguish the field labels from the field content.

security::validated_host_header: Made acceptance of configured vhosts the first check

Under certain conditions (such as running in a container, or reverse

proxy situations) the admin of a server wants to specify accepted host

names. This can be achieved in the "*/servers" section of a network

driver. These values are used now first for accepting host header

fields. This change avoids unexpected redirects to, e.g., internal

server addresses.

    • -35
    • +41
    ./packages/acs-tcl/tcl/security-procs.tcl
bugfix: fixed test test_ad_register_proc when running in a container

When runnig in a container, one cannot use util_current_localtion, which refers

to the URL to reach the server from the container host. To address the server

inside the container, acs::test::url should be used.

This change does not matter for non-containerized applications