• last updated 6 hours ago
Constraints
Constraints: committers
 
Constraints: files
Constraints: dates
Deactivate api-doc access for all registered users by default

Over many years, all "Registered Users" got per default access

to /api-doc. This is probably OK, when one assumes that the

registered users are developers. However, providing source code

access to all registered users can pose a security thread,

especially on large sites.

For new installs, api-doc is now just accessible for site-wide admins.

Providing more liberal rights for users can be achieved via

setting the permissions via the sitemap.

improve wording

don't create version directory in a checking function

fix typo

quote error message per default.

This should at least be the safe default assumption.

If in some cases it is necessary to relax this, one should

provide a swith for the non-default case.

align spelling to LDP recommendations

improve Oracle compatibility (many thanks to Raul Rodriguez)

  1. … 2 more files in changeset.
make spelling more consistent

improve source code comments

new feature for caching infrastructure: flag "-per_request"

When this feature is used, the cache is locked max 1 time per request,

the results are stable for this request. This feature is useful for caches

having a potentially high number of locks per request.

The new feature is used currently for checking, if a package is enabled.

Util user messages reform: do not store the messages persistently in the database, as they are volatile in nature

Util user message reform: when a message is repeated, do not create a new entry, but just increase a counter, which will be displayed when the message is retrieved

Increase test coverage

revert escaped version

reduce verbosity

Give people the chance to use OpenACS with WithDeprecatedCode set to 0

When OpenACS is configured to omit loading of long deprecated code

(WithDeprecatedCode set to 0) files like deprecated-procs.tcl are not

loaded. Therefore, these files should only contain code, which was

deprecated at LEAST ONE RELEASE EARLIER, such that site admins have

one release time to fix calls to deprecated code. This is especially

important for public procs.

Prefer acs::try_cache where the cache existance cannot be taken for granted (e.g. at upgrade)

Make acs::try_cache more robust to transitional situations during instance upgrade, where the object might exist, but not the method

Ignore also class definitions in the ignored namespaces

ns_quotehtml user submitted value inside error message to prevent potential XSS attack

Ignore the ::nsshell namespace: this is a NaviServer module, hence outside the OpenACS source tree

Document public api

  1. … 1 more file in changeset.
Add doc to public api, fix obvious bug

Document public api

  1. … 1 more file in changeset.
Document public api

Document public api

  1. … 1 more file in changeset.
Fix doc definition, add remark

Consider @see annotations as sufficient documentation

Add doc to public api

Make test more precise: some procs have just a newline in their doc instead of meaningful documentation...

Centralize retrieval of the test URL

  1. … 4 more files in changeset.