• last updated 10 hours ago
Constraints
Constraints: committers
 
Constraints: files
Constraints: dates
Removed LARS debugging log notices

Changed local_account_ok_p to get_local_account_status, which can also return no_account. Helps prevents problems with old cookies that do no longer have a corresponding user_id

  1. … 1 more file in changeset.
Added debug log statements to auth_token stuff

- Changed calls to ad_secure_conn_p to security::secure_conn_p

- Changed logic for ad_get_login_url, so it's more intelligent about the return_url

Rewrote cookie handling

  1. … 9 more files in changeset.
ext-auth #20: adding support for Login over HTTPS. New acs-kernel parameter RestrictLoginToSSLP. New API in security-procs.tcl for casting requests into HTTPS mode etc. Requiring secure connection in scripts passing password (registration, login, password-update)

  1. … 8 more files in changeset.
Cleaned up proc definitions

Require user_id in ad_change_password

Marking ad_acs_kernel_id public and ad_acs_kernel_id_mem private (was opposite)

  1. … 1 more file in changeset.
Let login URL include username/authority_id

Moved ad_maybe_redirect_for_registration over to auth::require_login

  1. … 1 more file in changeset.
Merged 4.6.4d1 (unreleased) to HEAD. This marks the end of the life of the oacs-4-6 branch.

  1. … 816 more files in changeset.
Patch #138: Various fixes to ensure people can be 'immersed' in a subsite.

Please see the patch description for all details.

  1. … 1 more file in changeset.
Made the redirect for registration redirect to the current subsite's register page. Also added ad_get_login_url and ad_get_logout_url procs to let you get the URL for login/logout, which direct the user to the current subsite's pages, and, optionally, can preseve the current page, including query variables/form.

1. Took out my earlier kludge to get around the AOLserver 4 ns_eval problem.

2. bracketed "if" exprs to avoid unnecessary recompilations of exprs

  1. … 15 more files in changeset.
Update the password_changed_date whenever the user's password is changed

  1. … 3 more files in changeset.
merge of 4.6.3b1 to HEAD

  1. … 107 more files in changeset.
add urls which can be accessed without logging in

make the -token_id flag work as advertised

ad_proc rather than proc on sec_sweep_sessions bug 263

rewrite the sessions_sweep query so it will use an index on last_hit

  1. … 1 more file in changeset.
add @see comments for most deprecated functions

  1. … 9 more files in changeset.
util_memoize_value_cached_p should be util_memoize_cached_p fixes bug 1546 patch 250

fixed couple ad_proc docstrings so they show up properly in api-browser

Merged with OpenACS 4.5 beta1 branch.

  1. … 88 more files in changeset.
Applied Michael Cleverly's patch #186 which preserves the session_id if a

user re-logs in after, say, being redirected from HTTP to HTTPS.

Applied Michael Cleverly's patch #188 which updates last_hit field of

sec_session_properties, which makes the code that sweeps out old, dead tuples

work.

Applied Michael Cleverly's patch #189, which cure's brokeness in signed

and verified values caused by IE's friendly insistence on inserting a CR

when it sees a LF.

Applied Michael Cleverly's patch #190, which closes a path which could in

theory be used maliciously as a form of DOS attack on an OpenACS 4 site.