• last updated 21 hours ago
Constraints
Constraints: committers
 
Constraints: files
Constraints: dates
Improved consistency with external programs

Since "unzip" is used as well on various other places,

use it as well in the file storage. This means that

the parameter "UnzipBinary" for the file-storage package

is now obsolete.

  1. … 1 more file in changeset.
strengthen boolean parameters in page contracts

  1. … 31 more files in changeset.
Improve validation

  1. … 1 more file in changeset.
Make use of new API "ad_mktmpdir" and "ad_opentmpfile" instead of "ad_tmpnam"

  1. … 6 more files in changeset.
Test the behavior of the file-storage when a malicious user would try to store a pre-existing file on the server as its own

The fix for the file-storage is a simple validation to make sure that the tmpfile exists, however, for the generic case of the file widget, we cannot trust the tmpfile value when this was not generated by the server. This will probably cause regression when one wants to show a "preview" of a form, to be continued.

  1. … 2 more files in changeset.
Make use of util::file_content_check and check also in other cases

This change also covers the case, where the checkmark for uploading

zip files was added marked in "upload file". It will also report

errors which were silently swalled before.

Bumped version number to 5.10.1d1

  1. … 2 more files in changeset.
Similar to the folder-create script, complain if the filename turns out empty after sanitizing

Port sanitizing of upload file name from downstream

improve spelling

  1. … 5 more files in changeset.
use "ad_file" as a means to avoid unexpected tilde substitution in file names

  1. … 12 more files in changeset.
Localize file-size limits in the UI

Introduce a client-side check for the maximum file size, inform user of current limit and improve file-size related localization

Prettify code

Bugfixes et al:

- don't throw a server error if one clicks submit on the empty form without specifying a file

- allow to upload the same zipfile multiple times without throwing an error

- streamline idioms

File storage max upload limit reform:

the max upload limit will now default to empty. Rationale: this value is

one that ages quickly with respect to new storage requirements, and is

currently set to something incompatible with the vanilla Naviserver configuration

(500MB fs vs 20MB ns).

The upgrade script will make so that instances setting this parameter

higher than the server upload limit configuration will be

set empty as well (this would never have an effect, as server

will prevent the upload altogheter anyway).

Max upload limit in bytes is now retrieved from a proc implementing

this fallback to server configuration logics. Other than centralizing,

its purpose is to be used in client-side code checks in the future

so we could prevent a doomed upload in advance.

  1. … 6 more files in changeset.
Whitespace changes

  1. … 3 more files in changeset.
remove conditions, which are always true

remove parens

  1. … 2 more files in changeset.
merged changes from the oacs-5-9 branch and resolved conflicts

  1. … 7834 more files in changeset.
Improve robustness of "file delete" operations

  1. … 19 more files in changeset.
Some more Tcl cleanup

- use curly brackes to enable byte code compilation

- don't use "[expr ...]" when not needed

- prefer "incr i -1" over "set i [expr {$i - 1}] "

  1. … 15 more files in changeset.
- use confirm handler instead of "onclick=..." in all packages in oacs-5-9

  1. … 15 more files in changeset.
- use event listener instead of onclick handler

- hint based on "fs_title_msg" is probably not shown since many years.

  1. … 1 more file in changeset.
- bump version number to 5.9.1d1

- improve security of page_contracts

  1. … 8 more files in changeset.
- handle case, where neither file_id nor folder_id is specified

.xql-file reform of file-storage

  1. … 18 more files in changeset.
- add editor hints to keep spaces/tabs in the future more consistent

  1. … 350 more files in changeset.
- standardize url construction to protect against injection attacks

- hardening page contracts

  1. … 8 more files in changeset.
- use type checking for boolean parameters in page_contracts to improve security

  1. … 14 more files in changeset.
Merging back to HEAD branch oacs-5-8 (using tag vg-merge-oacs-5-8-from-20141027).

  1. … 2547 more files in changeset.
- fix for bug #3234

this adresses as well issue #731

  1. … 2 more files in changeset.