OpenACS

Tools

Line History

Line Count Graph
Line Count Graph

Stats

Commits this week: 6
Total Committers: 146
Last Commit: 17 Dec
Commits this week: 6
Total Lines of Code (LoC): 7,561,010
Net change in LoC this week: 8

Commit Activity

Commits By Day In Week
52 week commits volume
Commits By Day In Week
Commits by day
Commits By Day In Week
Commits by hour
Commits By Hour In Day
Commit calendar
 

Most active committers (90 days)

loading
loading
  • last updated 40 mins ago
Constraints
Constraints: committers
 
Constraints: files
Constraints: dates
Wednesday 16 Oct
11:21 am

gustafn

Added code to skip suspicious looking query variables

On openacs.org, we are experiencing numerous requests with

multiply very long and strange query variables like in the example

below. So far, it is not clear, whether these requests are the

consequence of a double encoding or a deliberate attack. Many (most)

of the requests contain the query variable names containing the

(decoded) pattern "*amp;*".

This is a relatively new phenomenon. I cannot exclude that this is a

bug introduced lately in OpenACS, or a bug in an external bot, or

whatever. The problem with these query variables is that OpenACS

propagates these further, e.g., when updating query variables in

ad_dimensional, via export_vars, or return_urls.

Since OpenACS never uses these query-variables, these can be safely

skipped, without loosing functionality in OpenACS. It is possible to

construct examples, where skipping such variables can change the

semantics. Therefore, the change introduces a single function

util::suspicious_query_variable where in case of problems, the

skipping feature can be deactivated.

GET /api-doc/proc-browse?amp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3btype=All&amp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3borderby=name&type=All&amp%3btype=All&amp%3bamp%3btype=All&amp%3bamp%3bamp%3btype=All&amp%3bamp%3bamp%3bamp%3btype=All&amp%3bamp%3bamp%3bamp%3bamp%3btype=All&amp%3bamp%3bamp%3bamp%3bamp%3bamp%3btype=All&amp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3btype=All&amp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3btype=All&amp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3borderby=name&amp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3btype=Private&amp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3btype=All&amp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3btype=All&amp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3btype=All&amp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3borderby=name&amp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3bamp%3btype=All HTTP/1.1" 200 62378 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/605.1.15 (KHTML, like Gecko; compatible; FriendlyCrawler/1.0) Chrome/120.0.6099.216 Safari/605.1.15" "1729029614.331581 0.109805 0.000434 0.004026 0.215927

Options
    • -2
    • +2
    /openacs-4/packages/acs-tcl/acs-tcl.info
    • -4
    • +56
    /openacs-4/packages/acs-tcl/tcl/utilities-procs.tcl
    • -3
    • +3
    /openacs-4/packages/acs-templating/acs-templating.info
    • -1
    • +8
    /openacs-4/packages/acs-templating/tcl/dimensional-procs.tcl
    • -3
    • +3
    /openacs-4/packages/xotcl-core/xotcl-core.info
    • -6
    • +12
    /openacs-4/packages/xotcl-core/tcl/context-procs.tcl
    • -1
    • +11
    /openacs-4/packages/xotcl-core/www/show-object.tcl
10:49 am

gustafn

make skipping reason explicit

Options
    • -1
    • +1
    /openacs-4/packages/acs-tcl/tcl/test/http-client-procs.tcl
Sunday 13 Oct
11:03 am

gustafn

removed deprecated call

Options
    • -6
    • +10
    /openacs-4/packages/workflow/tcl/case-procs.tcl
10:50 am

gustafn

reduced verbosity

Options
    • -10
    • +10
    /openacs-4/packages/workflow/tcl/case-procs.tcl
Wednesday 09 Oct
4:47 pm

antoniop

Replace deprecated api

Options
    • -2
    • +2
    /openacs-4/packages/bug-tracker/tcl/bug-procs.tcl
4:43 pm

antoniop

Rework array idioms

Options
    • -26
    • +18
    /openacs-4/packages/bug-tracker/tcl/bug-procs.tcl
4:42 pm

antoniop

Finish array reform in this proc

Options
    • -8
    • +9
    /openacs-4/packages/acs-tcl/tcl/apm-install-procs.tcl
4:21 pm

antoniop

Rework array idioms

Options
    • -5
    • +3
    /openacs-4/packages/assessment/lib/assessment.tcl
    • -8
    • +4
    /openacs-4/packages/assessment/lib/section-items.tcl
    • -9
    • +5
    /openacs-4/packages/assessment/lib/session-items.tcl
    • -43
    • +34
    /openacs-4/packages/assessment/tcl/as-item-type-mc-procs.tcl
    • -6
    • +4
    /openacs-4/packages/assessment/www/asm-admin/catalog-item-add.tcl
    • -6
    • +4
    /openacs-4/packages/assessment/www/asm-admin/results-export.tcl
2:53 pm

antoniop

Whitespace cleanup

Options
    • -16
    • +16
    /openacs-4/packages/assessment/lib/section-items.tcl
2:42 pm

antoniop

Rework array idioms

Options
    • -14
    • +12
    /openacs-4/packages/acs-tcl/tcl/test/doc-check-procs.tcl
    • -13
    • +15
    /openacs-4/packages/acs-tcl/tcl/test/file-test-procs.tcl
2:14 pm

antoniop

Formatting changes

Options
    • -12
    • +12
    /openacs-4/packages/acs-tcl/tcl/test/db-proc-test-procs.tcl
2:10 pm

antoniop

Prefer unset to array unset when no pattern matching is needed

See https://wiki.tcl-lang.org/page/Dict+VS+Array+Speed

Options
    • -2
    • +2
    /openacs-4/packages/acs-tcl/tcl/test/db-proc-test-procs.tcl
2:06 pm

antoniop

Rework array idioms into dict idioms where appropriate

Options
    • -26
    • +21
    /openacs-4/packages/acs-mail-lite/tcl/test/email-inbound-procs.tcl
1:32 pm

antoniop

Cleanup array idioms

Options
    • -6
    • +5
    /openacs-4/packages/acs-content-repository/tcl/test/content-item-test-procs.tcl
1:27 pm

antoniop

Rework array idioms in dict idioms where appropriate, avoid unsetting arrays via pattern matching

Options
    • -27
    • +25
    /openacs-4/packages/acs-lang/tcl/test/acs-lang-test-procs.tcl
11:42 am

antoniop

Rework array idioms into dict idioms hwre appropriate, e.g.:

- when the return value of a proc is already a dict in itself

- when the return value of a proc should be completely overwritten in later tests

This avoids array "unwrapping" operations and unsets

Options
    • -259
    • +230
    /openacs-4/packages/acs-authentication/tcl/test/acs-authentication-procs.tcl
    • -29
    • +27
    /openacs-4/packages/acs-authentication/tcl/test/sync-test-procs.tcl
9:18 am

antoniop

Prefer unset to array unset when no pattern matching is needed

See https://wiki.tcl-lang.org/page/Dict+VS+Array+Speed

Options
    • -3
    • +3
    /openacs-4/packages/xotcl-request-monitor/tcl/throttle_mod-procs.tcl
    • -4
    • +5
    /openacs-4/packages/xowiki/tcl/test/xowiki-admin-tests-procs.tcl
Tuesday 08 Oct
5:27 pm

antoniop

Prefer unset to array unset when the whole array should be deleted

See https://wiki.tcl-lang.org/page/Dict+VS+Array+Speed

Options
    • -2
    • +2
    /openacs-4/packages/xml-rpc/tcl/system-procs.tcl
5:20 pm

antoniop

No need to fiddle in the ad_conn array if we just reset it

Options
    • -6
    • +2
    /openacs-4/packages/acs-tcl/tcl/request-processor-procs.tcl
5:16 pm

antoniop

Prefer unset to array unset when the whole array should be deleted

See https://wiki.tcl-lang.org/page/Dict+VS+Array+Speed

Options
    • -2
    • +2
    /openacs-4/packages/xowiki/tcl/includelet-procs.tcl
    • -2
    • +1
    /openacs-4/packages/xowiki/tcl/notification-procs.tcl
    • -2
    • +2
    /openacs-4/packages/xowiki/tcl/xowiki-procs.tcl
    • -9
    • +7
    /openacs-4/packages/acs-tcl/tcl/apm-install-procs.tcl
5:04 pm

antoniop

Prefer unset to array unset when the whole array should be deleted

See https://wiki.tcl-lang.org/page/Dict+VS+Array+Speed

Options
    • -2
    • +2
    /openacs-4/packages/search/tcl/search-procs.tcl
    • -1
    • +1
    /openacs-4/packages/xotcl-core/tcl/01-debug-procs.tcl
    • -2
    • +2
    /openacs-4/packages/xotcl-core/tcl/context-procs.tcl
    • -3
    • +3
    /openacs-4/packages/xotcl-core/tcl/cr-procs.tcl
    • -2
    • +2
    /openacs-4/packages/xotcl-core/www/show-object.tcl
    • -5
    • +5
    /openacs-4/packages/xotcl-request-monitor/tcl/throttle_mod-procs.tcl
    • -3
    • +3
    /openacs-4/packages/xotcl-request-monitor/www/stat-details.tcl
    • -2
    • +2
    /openacs-4/packages/xowf/tcl/xowf-procs.tcl
5:02 pm

antoniop

Prefer unset to array unset when the whole array should be deleted, rework array idioms into tcl idioms when an array is not needed

See https://wiki.tcl-lang.org/page/Dict+VS+Array+Speed

Options
    • -7
    • +5
    /openacs-4/packages/rss-support/tcl/rss-generation-procs.tcl
4:59 pm

antoniop

Prefer unset to array unset when we do not need a pattern match

See https://wiki.tcl-lang.org/page/Dict+VS+Array+Speed

Options
    • -5
    • +3
    /openacs-4/packages/notifications/tcl/notification-procs.tcl
4:55 pm

antoniop

Rework so that an array is not needed

Options
    • -8
    • +3
    /openacs-4/packages/new-portal/tcl/portal-procs.tcl
4:52 pm

antoniop

Prefer unset to array unset when the whole array should be deleted

See https://wiki.tcl-lang.org/page/Dict+VS+Array+Speed

Options
    • -2
    • +2
    /openacs-4/packages/forums/tcl/messages-procs.tcl
4:50 pm

antoniop

Rework array idioms

Options
    • -9
    • +7
    /openacs-4/packages/categories/tcl/category-list-procs.tcl
    • -5
    • +6
    /openacs-4/packages/categories/tcl/widget-procs.tcl
4:26 pm

antoniop

Modernize tcl idioms

Options
    • -11
    • +8
    /openacs-4/packages/acs-templating/tcl/query-procs.tcl
4:20 pm

antoniop

Prefer unset to array unset when the whole array should be deleted

See https://wiki.tcl-lang.org/page/Dict+VS+Array+Speed

Options
    • -7
    • +7
    /openacs-4/packages/acs-templating/tcl/head-procs.tcl
    • -2
    • +2
    /openacs-4/packages/acs-templating/tcl/list-procs.tcl
    • -3
    • +3
    /openacs-4/packages/acs-templating/tcl/query-procs.tcl
    • -1
    • +1
    /openacs-4/packages/caldav/tcl/caldav-procs.tcl
4:13 pm

antoniop

Prefer unset to array unset when the whole array should be deleted, rework array idioms into dict idioms to avoid unsetting the array, where appropriate

See https://wiki.tcl-lang.org/page/Dict+VS+Array+Speed

Options
    • -5
    • +7
    /openacs-4/packages/acs-tcl/tcl/apm-install-procs.tcl
    • -5
    • +5
    /openacs-4/packages/acs-tcl/tcl/apm-procs.tcl
    • -1
    • +1
    /openacs-4/packages/acs-tcl/tcl/form-processing-procs.tcl
    • -8
    • +6
    /openacs-4/packages/acs-tcl/tcl/site-nodes-procs.tcl
    • -2
    • +2
    /openacs-4/packages/acs-tcl/tcl/text-html-procs.tcl
3:55 pm

antoniop

Prefer unset to array unset when the whole array should be deleted

See https://wiki.tcl-lang.org/page/Dict+VS+Array+Speed

Options
    • -2
    • +2
    /openacs-4/packages/acs-subsite/tcl/subsite-procs.tcl