• last updated 4 hours ago
Constraints
Constraints: committers
 
Constraints: files
Constraints: dates
Fixed snyk vulnerability check

Snyk page has changed, we have to switch the pattern we are looking for.

Do not modify posted form data when logging the request. In addition mask log output for all fields having password in their name

Enhanced security logging and debugging in security-procs.tcl

- Updated the internal log procedure to accept multiple arguments (using join) for more flexible logging.

- Replace several ns_log calls with ::security::log to standardize logging of session_id, login_cookie, timeout, and other events.

- Add additional log statements in critical functions (e.g. sec_handler, sec_setup_session, __ad_verify_signature, and CSRF token handling)

to provide better traceability of session allocation, cookie generation, session invalidation, and signature verification.

- Improve debug output for CSRF token generation and verification, including logging differences in computed hash values.

added debugging hook for tracing CSRF livecyle

improved log messages to pinpoint location and reason

  1. … 1 more file in changeset.
fixed variable name

provent passwords from form being logged via ad_log

ad_return_url: provide a positive list and a negative list for selecting included query variables

The new parameters follow the terminology of the "export_vars" command.

ad_return_url: new parameter "-exclude"

This change allows to exclude certain variables (which are e.g. considered as

confidential) from the form, which computes the return_url.

The change is based on a feature request in the OpenACS forums by Josue Cardona.

reapplied post 5-10 release fix

Many thanks to Claudio Pasolini for reporting and identifying the problem!

Fixed 2 bugs: with remote code repository

- fixed repository URL when trying to "install-from-repositry"

on a checkout from the HEAD channel. The code tried to fetch

from a channel "6-0", which does not exist.

- determine the exact repository tag for repository channels

  1. … 1 more file in changeset.
Ported essential post-release fixes from oacs-5-10 branch

  1. … 2 more files in changeset.
improved comments

avoid triggering exception, when provided host header field cannot be resolved.

avoid error, when page_contract is called without an ns_set and without an open connection

Avoid calls to deprecated NaviServer functions

removed deprecated "ns_set new" by "ns_set create"

moved stuff for AOLserver 2 emulation to deprecated procs, mark it explicitly as deprecated

prefer more efficient approach to iterate over all key/values of an ns_set

Extend user_message feature so that a "severity" information can be passed alongside the message

This allows theme templates to color code messages according to their severity. Severity follows the Bootstrap nomenclature of "info", "success", "warning" and "danger".

Default severity has been set to "success" consistent with styling applied so far by OpenACS to the user messages.

  1. … 7 more files in changeset.
Extend test suite to cover :multiple and :array

improved documentation, removed AOLserver stuff

Remove AOLserver cruft

- reduced complexity of registering/invoking filters

- move more deprecated procs in acs-tcl to acs-tcl/tcl/deprecated-procs.tcl

    • -137
    • +8
    ./tcl/request-processor-procs.tcl
  1. … 4 more files in changeset.
Consider documentation the presence of an author

New API function: ad_docbook_xml_to_html

This function converts DocBook XML as used in the OpenACS

documentation to HTML. This is not a full implementation of all

possible DocBook markup, but just a subset sufficient for rendering a

substantial subset of the OpenACS documentation.

The function can be used via

set html [ad_html_text_convert -from application/docbook+xml -to text/html $text]

or

set txt [ad_html_text_convert -from application/docbook+xml -to text/plain $text]

fixedm typo in comment

rework register_icanuse "domDoc asTclValue" since w cannot use apm_version_names_compare during startup

Extend test suite

make use of new NaviServer command: ns_joinurl

the implementation provides a fallback when used with older versions of

NaviServer

fix comment of per_request_cache