Activity OpenACS/

A "formats" parameter can be specified on the formfields indicating one or more formats that we want to enforce. The syntax for any of such format is that of the Tcl clock command.

Default values have been set according to the expected behavior of each form field type.

Empty values are always considered valid. If a field is required, this will be enforced in its own validator.

- -2
- +2
/openacs-4/packages/xowiki/xowiki.info
- History
- Source
- Diff
/openacs-4/packages/xowiki/xowiki.info
- -0
- +3
/openacs-4/packages/xowiki/catalog/xowiki.de_DE.ISO-8859-1.xml
- History
- Source
- Diff
/openacs-4/.../xowiki.de_DE.ISO-8859-1.xml
- -0
- +3
/openacs-4/packages/xowiki/catalog/xowiki.en_US.ISO-8859-1.xml
- History
- Source
- Diff
/openacs-4/.../xowiki.en_US.ISO-8859-1.xml
- -11
- +69
/openacs-4/packages/xowiki/tcl/form-field-procs.tcl
- History
- Source
- Diff
/openacs-4/packages/.../form-field-procs.tcl

1:53 pm

antoniop

Test behavior of HTML5 date and time formfields when invalid values are submitted

- -0
- +186
/openacs-4/packages/xowiki/tcl/test/xowiki-test-procs.tcl
- History
- Source
- Diff
/openacs-4/packages/.../xowiki-test-procs.tcl

1:04 pm

gernst

Quote error message to better protect against XSS attacks

- -2
- +2
/openacs-4/packages/xotcl-core/tcl/context-procs.tcl
- History
- Source
- Diff
/openacs-4/packages/.../tcl/context-procs.tcl

12:21 pm

gustafn

Added default dbn to database drivers (acs::dc)

Align behavior with recent change in the xo::db inteface

- -5
- +12
/openacs-4/packages/acs-tcl/tcl/acs-db-00-procs.tcl
- History
- Source
- Diff
/openacs-4/packages/.../acs-db-00-procs.tcl

12:04 pm

gustafn

Added parameter to define a default dbn to a database connection

By this change, one can now define a default dbn at the creation time

of a database connection object. Before, it was necessary to pass

the "-dbn" value to every single command. The parameter can still be

used for particular queries as before to overrule the default.

Example for defining a connection context to a pool named "legacy"

using the PostgreSQL database interface

::xo::db::DB-postgresql create ::xo::dc1 -dialect postgresql -dbn legacy

lappend _ [::xo::dc1 get_value . {select count(*) from acs_objects}]

lappend _ [::xo::dc get_value . {select count(*) from acs_objects}]

#> 660 51606

- -10
- +15
/openacs-4/packages/xotcl-core/tcl/05-db-procs.tcl
- History
- Source
- Diff
/openacs-4/packages/.../tcl/05-db-procs.tcl

2:36 pm

antoniop

"An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can remove its sandboxing"

See e.g. https://cloud.google.com/blog/products/data-analytics/iframe-sandbox-tutorial

We set in xooauth/tcl/lti-procs.tcl a restrictive default (all sandboxing restrictions are applied by default). Users should relax it according to their embedded application.

xooauth/www/admin/lti-test.tcl is not really a productive file, so we set the already hardcoded value to no-sandboxing and note that this would be appropriate.

- -1
- +1
/openacs-4/packages/xooauth/tcl/lti-procs.tcl
- History
- Source
- Diff
/openacs-4/packages/.../tcl/lti-procs.tcl
- -7
- +8
/openacs-4/packages/xooauth/www/admin/lti-test.tcl
- History
- Source
- Diff
/openacs-4/packages/.../admin/lti-test.tcl

5:17 pm

hectorr

Remove duplicated entry

- -5
- +4
/openacs-4/packages/acs-tcl/tcl/test/acs-tcl-test-procs.tcl
- History
- Source
- Diff
/openacs-4/.../acs-tcl-test-procs.tcl

4:05 pm

File-Storage used to generate downloaded archives in tgz format, to then switch to zip, more user-friendly, in particular outside the Linux world (See https://openacs.org/forums/message-view?message_id=557561). To ease the transition, a couple of parameters and relative API were introduced that would allow to choose the preferred command one should use. During this reform however, default parameter values in the tcl code became inconsistent with those in the info file. Furthermore, the chosen defaults were set as absolute paths to the executable, which is not friendly to non-linux environments, or other scenarios where the "typical" Linux filesystem structure cannot be assumed (e.g. containers, MacOS...).

The only usage of this parameters/api was in fact in the download-archive vuh. In upstream codebase, no package references this file, not even the file-storage itself. Upon review, one could see that the file would also allow to specify a custom download filename via the path, which could be considered questionable. It would also execute the command in a way that once again assumes some form of Linux environment (e.g. invoking bash).

Save for the ability to customize the archive format and the anti-feature of being able to manipulate the archive filename via the path, the script largely relplicates www/download-zip, in a better shape after a few reforms hinted by e.g. penetration tools.

Given the aformentioned considerations, I have decided to make download-archive a simple redirect to download-zip. Specifying the object_id via the path will keep working, while URLs out there expecting the name to change will not fail, but the name will not be modified. The archive format will from now on be assumed to be zip.