• last updated 21 hours ago
Constraints
Constraints: committers
 
Constraints: files
Constraints: dates
harden page_contract

Make test more robust in setups where we cache permissions

    • -2
    • +39
    ./acs-tcl/tcl/test/test-permissions-procs.tcl
Cleanup commented code

Only allow valid privileges in the privs parameter

restrict substitution in string

Implement a package-specific page contract filter to collect current (and future) security fixes

    • -1
    • +39
    ./general-comments/tcl/general-comments-procs.tcl
    • -29
    • +2
    ./general-comments/www/comment-add-2.tcl
    • -19
    • +2
    ./general-comments/www/comment-edit-2.tcl
Reject frames and iframes in the content

    • -2
    • +12
    ./general-comments/www/comment-add-2.tcl
Prevent sneaking symlinks in the content repository

Many thanks to Thomas Rennner and Günter Ernst for analyzing the issue

    • -1
    • +11
    ./acs-content-repository/tcl/content-procs.tcl
cr_write_content reform

when serving files, do not trust the content information, as the absolute path to the file can be determined programmatically in this case.

This also reduce divergency between Oracle and Postgres

    • -8
    • +0
    ./acs-content-repository/tcl/revision-procs-oracle.xql
    • -8
    • +0
    ./acs-content-repository/tcl/revision-procs-postgresql.xql
    • -14
    • +9
    ./acs-content-repository/tcl/revision-procs.tcl
Fixed issue introduced in OpenACS 5.9.0

The old version did not insert a property value via the

sec_session_property__upsert() in PostgreSQL on the initial setting

(later updates were OK). The broken version was just adding a tuple

and left the "property_value" empty.

Many thanks to Jonathan Kelley for identifying the issue and reporting it.

file upgrade-5.10.1b4-5.10.1b5.sql was initially added on branch oacs-5-10.

Implement a new filter for inclass-exam submissions

When displayed by the print-answers method, allow to filter also for not graded.

    • -0
    • +1
    ./xowf/catalog/xowf.de_DE.ISO-8859-1.xml
    • -0
    • +1
    ./xowf/catalog/xowf.en_US.ISO-8859-1.xml
    • -0
    • +1
    ./xowf/catalog/xowf.it_IT.ISO-8859-1.xml
    • -11
    • +24
    ./xowf/www/resources/inclass-exam.js
added link to cluster info to acs-admin main page when cluster is enabled

    • -0
    • +1
    ./acs-admin/lib/site-wide-services.adp
    • -1
    • +1
    ./acs-admin/lib/site-wide-services.tcl
improved spelling

clean dirty editor buffer

    • -1
    • +1
    ./acs-bootstrap-installer/tcl/40-db-query-dispatcher-procs.tcl
improved spelling

    • -2
    • +3
    ./acs-bootstrap-installer/tcl/40-db-query-dispatcher-procs.tcl
    • -1
    • +1
    ./acs-bootstrap-installer/tcl/test/30-apm-load-procs.tcl
    • -3
    • +3
    ./xotcl-core/tcl/http-client-procs.tcl
Made startup more robust

- handle not-yet-defined callback procs gracefully

    • -3
    • +14
    ./acs-bootstrap-installer/tcl/00-proc-procs.tcl
updated version number of jquery (introduced not long ago)

    • -1
    • +1
    ./dotlrn-bootstrap3-theme/tcl/apm-callback-procs.tcl
Improved readability of configuration parameter "parameterSecret"

- Switched to camelCase for better readabilty and uniformity

- NaviServer configuration parameters are case insensitive, so no danger for backward compatibility

    • -4
    • +4
    ./acs-tcl/tcl/tcl-documentation-procs.tcl
Made .xql file more consistent by using dot notation

OpenACS for PostgreSQL uses since the release of 5.10.0 the dot

notation for the SQL function acs_permission.permission_p() to ease

portability with Oracle.

In general, one has to be careful that during an upgrade from an older

OpenACS version (e.g. 5.9.*) directly to 5.10.1 to upgrade process

does not depend on the dot notation, otherwise the upgrade will fail.

One should be safe for most UI functions in this respect.

Expand permission test suite to include definition of custom privileges in a couple of setups

    • -11
    • +221
    ./acs-tcl/tcl/test/test-permissions-procs.tcl
Provide an automated test of "advanced" permission features: permission inheritance via group, or via the permission context

    • -1
    • +203
    ./acs-tcl/tcl/test/test-permissions-procs.tcl
Use a simpler approach to achieve the intended result, which does not rely on events

Keep comments on the server side

JS upstream updates

- Updated highcharts to 11.4.0 (when highcharts package is not installed)

- Updated jquery-3.6.3 to jquery-3.7.1.

- Bumped version number to 5.10.1b10

    • -10965
    • +0
    ./xowiki/www/resources/jquery/jquery-3.6.4.js
    • -0
    • +10716
    ./xowiki/www/resources/jquery/jquery-3.7.1.js
Ensure chat javascript is executed only when the chat itself is actually a part of the DOM

This may not be the case at the time of rendering, e.g. because the chat is rendered inside of a <template> tag and appended to the document at a later moment.

JS upstream updates

- Updated upstream library to 11.4.0

- Bumped version to 0.5

JS upstream updates

- Updated jquery-3.6.3 to jquery-3.7.1.

- Bumped version to 5.10.1b2

    • -2
    • +2
    ./openacs-bootstrap3-theme/openacs-bootstrap3-theme.info
    • -1
    • +1
    ./openacs-bootstrap3-theme/tcl/resource-init.tcl
JS upstream updates

- Updated boostrap5 to 5.3.3

- Updated jquery-3.6.3 to jquery-3.7.1.

- Bumped version to 5.10.1b4

    • -2
    • +2
    ./openacs-bootstrap5-theme/openacs-bootstrap5-theme.info
    • -1
    • +1
    ./openacs-bootstrap5-theme/tcl/resource-init.tcl
    • -1
    • +1
    ./openacs-bootstrap5-theme/tcl/resource-procs.tcl
file jquery-3.7.1.js was initially added on branch oacs-5-10.

    • -0
    • +0
    ./openacs-bootstrap5-theme/www/resources/js/jquery-3.7.1.js
    • -0
    • +0
    ./openacs-bootstrap3-theme/www/resources/js/jquery-3.7.1.js
    • -0
    • +0
    ./xowiki/www/resources/jquery/jquery-3.7.1.js