OpenACS / openacs-4 / packages / xowiki / tcl

xowiki-www-procs.tcl

Tools

Line History

Line Count Graph
Line Count Graph

Stats

Commits this week: 0
Total Committers: 8
Last Commit: 19:25
Commits this week: 0
Total Lines of Code (LoC): 3,243
Net change in LoC this week: 0

Commit Activity

Commits By Day In Week
52 week commits volume
Commits By Day In Week
Commits by day
Commits By Day In Week
Commits by hour
Commits By Hour In Day
Commit calendar
 

Most active committers (90 days)

loading
loading
  • last updated 1 hour ago
Constraints
Constraints: committers
 
Constraints: files
Constraints: dates
Tuesday 30 Jan
6:18 pm

gustafn

Reduced attack vectors for query and form variables while keeping semantics

- improve form_parameter and query variable validation

- revert partly change: it is intentional that in case of validation errors, the

instances variables of the in-memory object contain invalid data in order

to be able to show the use the invalid data in the form.

- prefer "string first" idiom over regular expression

Options
    • -54
    • +49
    ./xowiki-www-procs.tcl
5:35 pm

antoniop

Fix typo

Options
    • -2
    • +1
    ./xowiki-www-procs.tcl
Tuesday 23 Jan
2:20 pm

antoniop

Revert to an approach that will not change the [self] object, which has unexpected consequences

Options
    • -2
    • +9
    ./xowiki-www-procs.tcl
Monday 22 Jan
3:52 pm

antoniop

Use a better idiom to revert changes on the object, that e.g. will handle the same arrays and variables

Options
    • -4
    • +2
    ./xowiki-www-procs.tcl
Wednesday 20 Dec 2023
2:13 pm

antoniop

Port of downstream modification:

do not restrict the format the user can supply. Sanitize the filename later and complain only if this is made exclusively of invalid characters.

Options
    • -2
    • +12
    ./xowiki-www-procs.tcl
12:04 pm

antoniop

get_form_data reform:

when validation fails, revert all changes performed on the object while filling up the form fields.

Rationale: when validation fails, we do not persist the data. The same we should not let unvalidated data sneak into the object, as this may be e.g. displayed on the page or be otherwise used by the system.

Options
    • -1
    • +15
    ./xowiki-www-procs.tcl
Thursday 14 Dec 2023
10:57 am

antoniop

Do not retrieve extra_css from query_parameters, as this is vulnerable to injections

Many thanks to Markus Moser

Options
    • -2
    • +4
    ./xowiki-www-procs.tcl
Friday 24 Nov 2023
1:56 pm

antoniop

Fix syntax of new oneof value checker

Options
    • -3
    • +3
    ./xowiki-www-procs.tcl
  2. … 1 more file in changeset.
Thursday 23 Nov 2023
12:14 pm

antoniop

Validate nls_language so that the only values allowed are existing enabled locales

Options
    • -3
    • +15
    ./xowiki-www-procs.tcl
  2. … 1 more file in changeset.
Thursday 14 Sep 2023
12:26 am

gustafn

move "-destroy_on_cleanup" towards the end of the parameter list

This change improves protection about ambiguous user input

Options
    • -4
    • +5
    ./xowiki-www-procs.tcl
  2. … 8 more files in changeset.
Thursday 25 May 2023
2:27 pm

trenner

use wordchar instead of word

Options
    • -4
    • +4
    ./xowiki-www-procs.tcl
Friday 12 May 2023
8:16 pm

gustafn

intensify validation of form variables

Options
    • -7
    • +7
    ./xowiki-www-procs.tcl
  2. … 1 more file in changeset.
Wednesday 29 Mar 2023
4:12 pm

antoniop

Update api

Options
    • -7
    • +5
    ./xowiki-www-procs.tcl
Monday 27 Feb 2023
7:48 pm

gustafn

Use signed value for form_parameter "__object_name"

Bumped version number to 5.10.1d40

Options
    • -7
    • +7
    ./xowiki-www-procs.tcl
  2. … 3 more files in changeset.
Wednesday 22 Feb 2023
1:57 pm

gustafn

increased value checking for paramter that might be influenced by user input

Options
    • -2
    • +2
    ./xowiki-www-procs.tcl
  2. … 8 more files in changeset.
Thursday 15 Dec 2022
8:30 pm

gustafn

improved checking of parameter values, which might be influenced via query parameters

Options
    • -7
    • +7
    ./xowiki-www-procs.tcl
  2. … 6 more files in changeset.
Wednesday 30 Nov 2022
9:36 am

gustafn

reduce verbosity

Options
    • -2
    • +2
    ./xowiki-www-procs.tcl
Tuesday 08 Nov 2022
2:24 pm

gustafn

Added support for passing parameter_name:value_constraint to xowiki::Package->get_parameter

- The get_parameter method can get values from query-parameters, therefore

we have to validate these.

- Use the new feature at several places (especially for boolean values)

- Still, more places should be checked

- bumped xowiki to 5.10.1d37

- bumped xotcl-core to 5.10.1d14

Options
    • -10
    • +10
    ./xowiki-www-procs.tcl
  2. … 10 more files in changeset.
Monday 17 Oct 2022
4:24 pm

trenner

query_parameter_return_url is defined on the package

Options
    • -2
    • +2
    ./xowiki-www-procs.tcl
Tuesday 11 Oct 2022
3:20 pm

gustafn

improve spelling

Options
    • -3
    • +5
    ./xowiki-www-procs.tcl
  2. … 7 more files in changeset.
Tuesday 04 Oct 2022
5:00 pm

antoniop

Validate field names when these might come directly from the POST request and therefore contain arbitrary text

Options
    • -3
    • +20
    ./xowiki-www-procs.tcl
Tuesday 13 Sep 2022
11:56 am

antoniop

Fix typo in comment

Options
    • -2
    • +2
    ./xowiki-www-procs.tcl
Monday 29 Aug 2022
11:51 am

antoniop

Use existing api to tell whether a formfield is disabled or not and to set/unset disabled on a field, handle the case of checkboxes and select fields, where the attribute should not be set whe it is false (e.g. disabled=0 == disabled)

This fixes upstream automated tests on xowiki and xowf

Options
    • -9
    • +9
    ./xowiki-www-procs.tcl
  2. … 1 more file in changeset.
Thursday 25 Aug 2022
11:53 am

gustafn

Fixed serious bug killing at least short-text questions in inclass exam

The bug was introduced in [1], by testing for the existence of the

disabled attribute, and when it exists, it was omitting values

reading. The problem is that when form-fields are reset, the

"disabled" attribute is set to 0, leading the exists check to

succeed. In essence, This change sets now the default value of the

form-field to "0", such that it is safe to test it everywhere.

Originally, it was not set by default to save resources (memory and

processing power), but this requires a more careful analysis when

changes happen.

[1] https://fisheye.openacs.org/browse/OpenACS/openacs-4/packages/xowiki/tcl/xowiki-www-procs.tcl?r1=1.368.2.125&r2=1.368.2.126

Options
    • -12
    • +11
    ./xowiki-www-procs.tcl
  2. … 1 more file in changeset.
Sunday 21 Aug 2022
6:46 pm

gustafn

rename "iconified file" to "thumbnail file"

Options
    • -3
    • +3
    ./xowiki-www-procs.tcl
  2. … 3 more files in changeset.
Saturday 20 Aug 2022
5:43 pm

gustafn

Extended functionality of the DropZone widget

- added parameters "label", "disposition" and "file_name_prefix"

for better configurability

- added support for updating the current page with feedback of the

dropped files. This is used e.g. by the online exam in the exam

protocol to display incrementally thumbnails of feedback files.

- change property "uploader" to "disposition", since "uploader" is

somewhat ambiguous. "Disposition" defines, what happens after the

file was uploaded, e.g. whether the content has to be transformed,

etc.

- bumped version number to 5.10.1d35

Options
    • -14
    • +33
    ./xowiki-www-procs.tcl
  2. … 5 more files in changeset.
Wednesday 17 Aug 2022
7:06 pm

gustafn

Generalized handling of local_return_url

I am not fully happy with the handlings of "return_url" in exam workflows.

Maybe this can be reworked in a way such that "local_return_url" is not

neccsessary in the future.

Options
    • -5
    • +4
    ./xowiki-www-procs.tcl
  2. … 1 more file in changeset.
Thursday 11 Aug 2022
8:22 pm

antoniop

Skip processing for all formfields that are defined as disabled:

the browser should not send us these data in the first place.

Options
    • -21
    • +29
    ./xowiki-www-procs.tcl
Wednesday 13 Jul 2022
1:00 pm

gustafn

undo part of last change

unfortunatly, the 0.9.3 issue can't be fixed so simple as hoped. The "-html" flag is necessary for dealing with autoclosed entries.

Options
    • -2
    • +2
    ./xowiki-www-procs.tcl
  2. … 1 more file in changeset.
12:41 pm

gustafn

for orthogonaly, remove "-html" flag from dom parse to avoid a potential top-level <html> element

Options
    • -2
    • +2
    ./xowiki-www-procs.tcl
  2. … 4 more files in changeset.