Activity OpenACS/openacs-4/packages/acs-tcl

Tree
Accordion

Stats

Commits this week: 16

Total Committers:	73
Last Commit:	28 Dec 24
Commits this week:	16
Total Lines of Code (LoC):	74,868
Net change in LoC this week:	25

Commit Activity

last updated 7 hours ago

Constraints

Constraints: committers

Committer:

Log Comment:

Constraints: files

File Extension:

File Name:

Constraints: dates

Start Date:

End Date:

Monday 18 Mar 2024

2:13 pm

antoniop

Strenghten validation against smarter attempts to disguise the javascript: protocol

- -10
- +17
./tcl/text-html-procs.tcl
- History
- Source
- Diff
./tcl/text-html-procs.tcl

2:12 pm

antoniop

Replicate a smarter attempt by a penetration tool to disguise the javascript: protocol

- -11
- +24
./tcl/test/text-html-procs.tcl
- History
- Source
- Diff
./tcl/test/text-html-procs.tcl

Thursday 29 Feb 2024

12:21 pm

gustafn

Added default dbn to database drivers (acs::dc)

Align behavior with recent change in the xo::db inteface

- -5
- +12
./tcl/acs-db-00-procs.tcl
- History
- Source
- Diff
./tcl/acs-db-00-procs.tcl

Tuesday 27 Feb 2024

5:17 pm

hectorr

Remove duplicated entry

- -5
- +4
./tcl/test/acs-tcl-test-procs.tcl
- History
- Source
- Diff
./tcl/test/acs-tcl-test-procs.tcl

Monday 26 Feb 2024

12:54 pm

gustafn

removed legacy code from apm_transfer_file

util::http::get should be everywhere available

- -57
- +3
./tcl/apm-file-procs.tcl
- History
- Source
- Diff
./tcl/apm-file-procs.tcl

12:09 pm

gustafn

Rework of util::which

The new version deals now correctly with absolute paths,

where just the extensions are added, and it is checked

whether the program is executable.

Extended regression test to deal with optional and required

external dependencies. Missing optional external programs

produce warnings.

- -30
- +46
./tcl/utilities-procs.tcl
- History
- Source
- Diff
./tcl/utilities-procs.tcl
- -31
- +91
./tcl/test/acs-tcl-test-procs.tcl
- History
- Source
- Diff
./tcl/test/acs-tcl-test-procs.tcl

12:05 pm

gustafn

Reduced redundancy

call text_templates::create_pdf_from_html from

text_templates::create_pdf_content instead of replicating logic

- -31
- +27
./tcl/pdf-procs.tcl
- History
- Source
- Diff
./tcl/pdf-procs.tcl

12:03 pm

gustafn

Use for new installation relative path names for external programs per default

- -1
- +1
./acs-tcl.info
- History
- Source
- Diff
./acs-tcl.info

Sunday 25 Feb 2024

6:25 pm

gustafn

Cleanup of external binaries: always use "util::which" to resolve binaries

Background: it is important to always use the same binaries of some

programs. This is important for security reasons, consistency, and

configurability (some operating systems have read-only file systems,

which might be on the path and should be avoided for some operations).

- -2
- +2
./tcl/test/http-client-procs.tcl
- History
- Source
- Diff
./tcl/test/http-client-procs.tcl

5:13 pm

gustafn

Cleanup of external binaries: always use "util::which" to resolve binaries

Background: it is important to always use the same binaries of some

programs. This is important for security reasons, consistency, and

configurability (some operating systems have read-only file systems,

which might be on the path and should be avoided for some operations).

- -2
- +2
./tcl/http-client-procs.tcl
- History
- Source
- Diff
./tcl/http-client-procs.tcl
… 3 more files in changeset.

4:46 pm

gustafn

Use GNU grep when available

GNU grep is now used for the lookup of message keys using the

"--include=" parameter. This improves the speed of the command

significantly and reduces the number of external dependencies (no

"find", or "xargs" needed).

- -8
- +9
./tcl/00-icanuse-procs.tcl
- History
- Source
- Diff
./tcl/00-icanuse-procs.tcl
… 1 more file in changeset.

11:49 am

gustafn

Cleanup of external binaries: always use "util::which" to resolve binaries

- -3
- +3
./tcl/apm-file-procs.tcl
- History
- Source
- Diff
./tcl/apm-file-procs.tcl

Friday 23 Feb 2024

2:14 pm

antoniop

Improve test:

whether the html filter will accept or not a script tag is configuration-dependent. We now enforce that the outcome is consistent with the security check for HTML used in the filter itself.

- -1
- +1
./tcl/test/acs-tcl-test-procs.tcl
- History
- Source
- Diff
./tcl/test/acs-tcl-test-procs.tcl

Friday 16 Feb 2024

12:38 pm

antoniop

Manually replace the "&colon;" entity to prevent attempts at disguising "javascript:" links

- -1
- +17
./tcl/text-html-procs.tcl
- History
- Source
- Diff
./tcl/text-html-procs.tcl

12:36 pm

antoniop

Replicate injection attempt by penetration tools

- -0
- +14
./tcl/test/text-html-procs.tcl
- History
- Source
- Diff
./tcl/test/text-html-procs.tcl

Thursday 15 Feb 2024

7:04 pm

gustafn

page filters with NUL value

Prefer "string first" over "regexp" since this is twice as fast.

- -4
- +5
./tcl/tcl-documentation-procs.tcl
- History
- Source
- Diff
./tcl/tcl-documentation-procs.tcl

5:47 pm

gustafn

security::validated_host_header: Made acceptance of configured vhosts the first check

Under certain conditions (such as running in a container, or reverse

proxy situations) the admin of a server wants to specify accepted host

names. This can be achieved in the "*/servers" section of a network

driver. These values are used now first for accepting host header

fields. This change avoids unexpected redirects to, e.g., internal

server addresses.

- -35
- +41
./tcl/security-procs.tcl
- History
- Source
- Diff
./tcl/security-procs.tcl

5:41 pm

gustafn

bugfix: fixed test test_ad_register_proc when running in a container

When runnig in a container, one cannot use util_current_localtion, which refers

to the URL to reach the server from the container host. To address the server

inside the container, acs::test::url should be used.

This change does not matter for non-containerized applications

- -2
- +2
./tcl/test/request-processor-procs.tcl
- History
- Source
- Diff
./tcl/test/request-processor-procs.tcl

1:27 pm

antoniop

Provide facilities to validate against invalid SQL strings

We introduce a new page contract filter and nsf validator called "dbtext". They implement enforcing of a value to be useable in an SQL query. Currently, this means that the value should not contain the NUL character, but the definition may change in the future or become database-specific.

The html contract filter has also be extended to reject the NUL character.

The test suite has been updated/extended to reflect the changes.

- -2
- +30
./tcl/tcl-documentation-procs.tcl
- History
- Source
- Diff
./tcl/tcl-documentation-procs.tcl
- -5
- +41
./tcl/test/acs-tcl-test-procs.tcl
- History
- Source
- Diff
./tcl/test/acs-tcl-test-procs.tcl
… 1 more file in changeset.

Tuesday 13 Feb 2024

5:48 pm

antoniop

Reform of error handling in ad_page_contract when template recursion is detected

A "complaint recursion" happens if a validation error takes place in one of the templates used while rendering the error page (for instance, anything we include in the master template or the master template itself).

Previously, we would give up complaining after 10 recursions were detected. This had the consequence that after 10 attempt, the failing template involved in rendering the complaint would be fed the invalid data we were trying to reject.

Now, we complain and stop the execution as soon as a recursion is detected. The error will be rendered in a very basic way that overrides the templating system, so that we can exit the recursion cycle.

In practice, only malicious page manipulation attempts should be affected by this change.