Activity OpenACS/

5:33 pm

antoniop

Don't reset the upload timeout on audio uploads

- -2
- +13
/openacs-4/packages/proctoring-support/www/resources/proctored-page.js
- History
- Source
- Diff
/openacs-4/packages/.../proctored-page.js

4:17 pm

antoniop

Make "standard" the default preset we apply to richtext editors

This is needed to have consistent site-wide default settings coming from the tcl level, such as connection context information and more.

- -5
- +13
/openacs-4/packages/acs-templating/tcl/richtext-procs.tcl
- History
- Source
- Diff
/openacs-4/packages/.../richtext-procs.tcl
- -2
- +8
/openacs-4/packages/xowiki/tcl/form-field-procs.tcl
- History
- Source
- Diff
/openacs-4/packages/.../form-field-procs.tcl

1:25 pm

antoniop

Render richtext as div reform

Some richtext editors, such as TinyMCE in inline mode, do not expect

to enhance a textarea, but a div.

We could already override the rendering in the richtext editor

subclass, but this has the consequence that inheritance would be

interrupted. This prevents from plugging behavior in subclasses of the

richtext formfield.

This reform refactors render_richtext_as_div from the richtext

formfield into render_as_div on the textarea class. It also supports a

flag for subclasses to instruct the superclass that they should render

the field as div AFTER the whole inheritance chain was applied.

- -23
- +41
/openacs-4/packages/xowiki/tcl/form-field-procs.tcl
- History
- Source
- Diff
/openacs-4/packages/.../form-field-procs.tcl

12:47 pm

antoniop

Do not assume the repeated field will be attached as a direct child of the observed element

This is not the case in some downstream implementations

- -4
- +4
/openacs-4/packages/xowiki/tcl/form-field-procs.tcl
- History
- Source
- Diff
/openacs-4/packages/.../form-field-procs.tcl

11:35 am

antoniop

Include the attribute to identify a repeated field also when we render richtext as div

- -2
- +2
/openacs-4/packages/xowiki/tcl/form-field-procs.tcl
- History
- Source
- Diff
/openacs-4/packages/.../form-field-procs.tcl

4:08 pm

antoniop

Port of downstream modification in place since at least 2012

When parsing XoWiki links, accept links in the form [[link|| -flag1 flagvalue]], where the label is set to empty.

- -2
- +2
/openacs-4/packages/xowiki/tcl/xowiki-procs.tcl
- History
- Source
- Diff
/openacs-4/packages/.../tcl/xowiki-procs.tcl

2:28 pm

antoniop

Port of downstream fix by Markus Moser on live since 2022-09-21

Fix regression after disabled formfield reform

- -3
- +5
/openacs-4/packages/xowiki/tcl/form-field-procs.tcl
- History
- Source
- Diff
/openacs-4/packages/.../form-field-procs.tcl

4:26 pm

antoniop

Fix variable name after refactoring

- -2
- +2
/openacs-4/packages/acs-tcl/tcl/security-procs.tcl
- History
- Source
- Diff
/openacs-4/packages/.../security-procs.tcl

7:04 pm

gustafn

fixed typo

- -2
- +2
/openacs-4/packages/acs-tcl/tcl/security-procs.tcl
- History
- Source
- Diff
/openacs-4/packages/.../security-procs.tcl

11:26 am

gustafn

Updated location handling

- make use of "ns_server hosts" when available

- refactored and simplified code

- keep validated locations in an nsv array

- added support for extra white-listed hosts

in case, every other configuration fails

(should not be necessary)

ns_section ns/server/$server/acs {

ns_param whitelistedHosts {...}

}

- updated inline documentation

The new code is supposed to handle in combination of a recent NaviServer

all complex host header validation scenarios, include running behind a proxy,

in a container or cluster.

- -79
- +183
/openacs-4/packages/acs-tcl/tcl/security-procs.tcl
- History
- Source
- Diff
/openacs-4/packages/.../security-procs.tcl

11:15 am

gustafn

Updated icanuse registry

- added "ns_ip", "ns_subnetmatch", and "ns_server hosts"

- sorted commands alphabetically

- -7
- +10
/openacs-4/packages/acs-tcl/tcl/00-icanuse-procs.tcl
- History
- Source
- Diff
/openacs-4/packages/.../00-icanuse-procs.tcl

3:18 pm

gustafn

whitespace changes

- -19
- +19
/openacs-4/packages/acs-tcl/tcl/html-procs.tcl
- History
- Source
- Diff
/openacs-4/packages/.../tcl/html-procs.tcl

3:18 pm

gustafn

modernize code

- -4
- +2
/openacs-4/packages/acs-tcl/tcl/html-procs.tcl
- History
- Source
- Diff
/openacs-4/packages/.../tcl/html-procs.tcl

2:20 pm

gustafn

moved long time deprecated function "ad_approval_system_inuse_p" to deprecated-procs

- -18
- +1
/openacs-4/packages/acs-tcl/tcl/admin-procs.tcl
- History
- Source
- Diff
/openacs-4/packages/.../tcl/admin-procs.tcl
- -2
- +19
/openacs-4/packages/acs-tcl/tcl/deprecated-procs.tcl
- History
- Source
- Diff
/openacs-4/packages/.../deprecated-procs.tcl

2:14 pm

gustafn

Improved comments and make code more robust in regards of legacy setups

- -12
- +20
/openacs-4/packages/acs-tcl/tcl/request-processor-procs.tcl
- History
- Source
- Diff
/openacs-4/.../request-processor-procs.tcl

7:47 pm

gustafn

Added support for relative redirects

RFC 2616 requires an absolute URI in the "Location" header field. So

if someone calls "ns_returnredirect /", NaviServer transforms it on

the fly into an absolute URL by prefixing it with the location

(e.g. https://openacs.org/). NaviServer (and OpenACS) has some complex

code to compute the location value, especially when virtual servers

are involved (or for "host-node mapped" subsites in OpenACS). The

situation is further complicated when running behind a reverse proxy

and/or in a containerized environment. In such cases, the location is

computed from the "host" request header field, which must be

validated, otherwise an attacker could hijack a session and redirect

it to a spoofed site.

The situation changed 10 years ago (June 2014) with the introduction

of RFC 7231, which allows relative redirects (see

https://www.rfc-editor.org/rfc/rfc7231#section-7.1.2). Using relative

redirects greatly simplifies configuration and closes the attack

vector using the host header field. RFC 7231 has been superseded by

RFC 9110 (June 2022), which also supports relative redirects via the

"location" response header field (see

https://www.rfc-editor.org/rfc/rfc9110#field.location).

Since OpenACS prefixed always the URL with a location, when it

encounters are relative URL in a "ad_returnredirect", this change

makes use of the new feature of NaviServer 5.

Make sure to use a current version of NaviServer, where the support

was added recently.

- -0
- +14
/openacs-4/packages/acs-tcl/tcl/00-icanuse-procs.tcl
- History
- Source
- Diff
/openacs-4/packages/.../00-icanuse-procs.tcl
- -4
- +10
/openacs-4/packages/acs-tcl/tcl/utilities-procs.tcl
- History
- Source
- Diff
/openacs-4/packages/.../utilities-procs.tcl

3:57 pm

antoniop

Document more explicitly that we do not perform filesystem operations when deleting files via the fs:: api, but we rely on the content repository and its trigger+scheduled proc mechanism

- -3
- +18
/openacs-4/packages/file-storage/tcl/file-storage-procs.tcl
- History
- Source
- Diff
/openacs-4/.../file-storage-procs.tcl

3:45 pm

antoniop

Document behavior: the assumption that one can derive the filename from the api is not correct in case of copies

- -0
- +11
/openacs-4/packages/acs-content-repository/tcl/revision-procs.tcl
- History
- Source
- Diff
/openacs-4/packages/.../revision-procs.tcl

3:10 pm

antoniop

Revert https://cvs.openacs.org/changelog/OpenACS?cs=oacs-5-10%3Aantoniop%3A20240423144330

currently, file-storage will copy files by simply copying the revision entry of the new file from the original one. This means that copied files will in fact point to the same filesystem file of the original.

This "works" because the file-storage api will currently never delete a file from the filesystem, so deleting the original file will not affect the copies.

This behavior is probably not ideal, but we won't address it before the release, as to change it will most likely require some careful planning, in particular for existing installations.