• last updated 4 hours ago
Constraints
Constraints: committers
 
Constraints: files
Constraints: dates
flipping of session_id apparently works without keeping track of the old session_id, so there is no need of keeping track of it

improved comments

Small optimization for cachingmode "none": no need to broadcast cache flushing

fix missing colon (many thanks to Marty Israelsen for reporting)

Use NaviServer feature "ns_deletecookie ... -samesite $samesite ..." when available.

fix brackets

bump version number to 5.10.1d14

    • -2
    • +2
    ./catalog/acs-tcl.en_US.ISO-8859-1.xml
added argument handling to try_cache operations

removed unused query (many thanks to Franz Penz for noting)

reduce verbosity

whitespace cleanup

added sni hostname and redirect on 301 and 302

new API call ::security::csp::add_static_resource_header

The API call set the CSP rule on the current connection for a static

resource depending on the MIME type.

# Sample definition for custom CSP rules for static files in the

# OpenACS configuration file.

#

# ns_section ns/server/$server/acs {

# ...

# ns_param StaticCSP {

# image/svg+xml "script-src 'none'"

# }

# ...

# }

bump version number of acs-tcl to 5.10.1d13

Added new private helper proc ::util::resources::download_helper

to deal with redirects on github, when "util::http::get" is used.

New feature: cookie namespaces

So far, all OpenACS versions used "ad_" as a prefix for cookies (such

as ad_login, ad_session_id, ...). In certain situations this can lead

to confusion, since cookies are managed by browsers via domain names,

and running multiple OpenACS instances in the same domain will cause

overwriting of such cookies by these instances. The can happen e.g.

when running multiple instances on the same machine, or using

port-forwarding to virtual machines/containers, using reverse proxies,

etc. Note that the cookie overwriting problem does not exist for

host-node-mapped subsites, since host-node-mapping depends on domain

names.

One could consider using the port in the cookie name (as

sometimes noted as an option), but this would not work, in case the

same server should be reachable over multiple ports.

Therefore, one can now specify a "CookieNamespace" in the OpenACS

configuration file, which is per default "ad_", which is sufficient

for the majority of installations. In cases, where it is needed, a

different CookieNamespace can now be configured.

To manage the cookie names internally, OpenACS provides a new API call

security::cookie_name to derive the namespaced cookie name from a stem.

Snippet of the OpenACS configuration file for setting the CookieNamespace

#---------------------------------------------------------------------

# OpenACS specific settings (per server)

#---------------------------------------------------------------------

ns_section ns/server/${server}/acs {

ns_param CookieNamespace "ad_"

...

}

cleanup: the updated version of the site-note code is appartently stable enough also for bootstrap situations

remove commented out coude

Provide better debug info in case "ns_parseurl" fails inside util::split_location

Factor our private function "util::ns_set_pretty_print" which might be

used also on other occasions.

rework of ad_decode

- modernize code

- improve performance

- extend regression test

Revert additional fallbacks, one should take care that ad_conn is invoked correctly

Provide further fallbacks for ad_conn

check that provided signature is a list, otherwise lassign will fail afterwards

Comment out test on WIP feature

fix for initial (boostrap) installation

slightly better way to handle testing in vanilla instances

Test exposing a suboptimal behavior: when we try to resolve the query via db_qd_get_fullname inside of OO code, a warning is generated

file acs-db-00-procs.tcl was initially added on branch oacs-5-10.

    • -0
    • +0
    ./tcl/test/acs-db-00-procs.tcl
reduce dependency on xo namespace in acs-core

redice verbosity

Fix quote_unquote_html test