OpenACS / openacs-4 / packages / acs-tcl / tcl

security-procs.tcl

Tools

Line History

Line Count Graph
Line Count Graph

Stats

Commits this week: 0
Total Committers: 22
Last Commit: 05 Apr
Commits this week: 0
Total Lines of Code (LoC): 2,822
Net change in LoC this week: 0

Commit Activity

Commits By Day In Week
52 week commits volume
Commits By Day In Week
Commits by day
Commits By Day In Week
Commits by hour
Commits By Hour In Day
Commit calendar
 

Most active committers (90 days)

loading
loading
  • last updated 4 hours ago
Constraints
Constraints: committers
 
Constraints: files
Constraints: dates
Friday 15 Feb 2019
2:25 pm

gustafn

ad_sign: generalize last ad_sign handling to

allow user and csrf binding

Options
    • -18
    • +29
    ./security-procs.tcl
  2. … 4 more files in changeset.
12:03 pm

gustafn

ad_sign: new optional parameter "user_binding"

The parameter user_binding allows to bind a signature to a user.

When the value is "-1" only the user who created the signature can

obtain the value again. A value of 0 (default) means no user binding.

The permissible values might be extended in the future.

bump version number to 5.10.0d24

Options
    • -10
    • +39
    ./security-procs.tcl
  2. … 2 more files in changeset.
Monday 11 Feb 2019
12:52 pm

gustafn

improve comments, make function private to avoid confusions

Options
    • -2
    • +9
    ./security-procs.tcl
Wednesday 30 Jan 2019
10:16 pm

gustafn

switch from security::nonce_token to ::security::csp::nonce and update comments

Options
    • -9
    • +9
    ./security-procs.tcl
Tuesday 15 Jan 2019
7:30 pm

gustafn

replace broken redirect with standard redirect function (auth::require_login)

Options
    • -9
    • +8
    ./security-procs.tcl
Saturday 22 Dec 2018
11:24 am

gustafn

no need for eagerly releasing handles

Options
    • -2
    • +1
    ./security-procs.tcl
Friday 30 Nov 2018
12:26 pm

gustafn

add procdic for private function

Options
    • -1
    • +5
    ./security-procs.tcl
12:21 pm

gustafn

Cookie security reform:

- fix handling of persistent logins while addressing problems of last commits

- increase usage of try/throw to be able to distinguish exceptions

- fix handling of LoginTimeout 0 in cryptographic expiration

- use [ad_conn behind_secure_proxy_p] on more occasions, where

security::secure_conn_p is used (maybe fold these together in the future)

- new private proc security::log to ease debugging of cookie management

- further improved documentation

Options
    • -126
    • +197
    ./security-procs.tcl
Thursday 29 Nov 2018
11:24 am

gustafn

- fix serveral documentation bugs (align decumentation with implementation)

- use "throw" as well for invalid cookies (in addition to non-existent cookies)

Options
    • -23
    • +51
    ./security-procs.tcl
Monday 26 Nov 2018
7:50 pm

gustafn

add session_id invalidation

Options
    • -1
    • +41
    ./security-procs.tcl
6:04 pm

gustafn

treat behind_secure_proxy_p like security::secure_conn_p for useing secure cookies in general and for the secure login cookie

Options
    • -3
    • +3
    ./security-procs.tcl
3:57 pm

gustafn

use secure token when running behind a secure proxy the same way as when running directly a secure session

Options
    • -3
    • +8
    ./security-procs.tcl
3:09 pm

gustafn

Don't trust value of login_level just on basis of the session cookie

Options
    • -1
    • +18
    ./security-procs.tcl
Sunday 25 Nov 2018
6:34 pm

gustafn

modernize exception handling: use proper try/throw instead of swallowing "catch"

Options
    • -5
    • +10
    ./security-procs.tcl
6:25 pm

gustafn

call sec_login_handler instead of just sec_generate_session_id_cookie, since otherwise, cryptographically valid session cookie could be used without a ad_login_cookie

Options
    • -5
    • +7
    ./security-procs.tcl
Saturday 03 Nov 2018
8:47 pm

gustafn

improve spelling

Options
    • -2
    • +2
    ./security-procs.tcl
  2. … 15 more files in changeset.
Wednesday 31 Oct 2018
6:56 pm

gustafn

make handling of session_ids more robust (necessary for user-switching feature)

Options
    • -29
    • +34
    ./security-procs.tcl
6:52 pm

gustafn

fix typo

Options
    • -2
    • +2
    ./security-procs.tcl
  2. … 1 more file in changeset.
Monday 15 Oct 2018
9:51 am

gustafn

factor out validation of provided host header.

report only onece, that host header is invalid

Options
    • -4
    • +25
    ./security-procs.tcl
  2. … 2 more files in changeset.
Thursday 20 Sep 2018
10:10 pm

hectorr

Fix typo in proc doc

Options
    • -2
    • +2
    ./security-procs.tcl
6:50 pm

hectorr

Fix typos in proc doc

Options
    • -5
    • +5
    ./security-procs.tcl
Wednesday 19 Sep 2018
2:55 am

gustafn

improve comments

Options
    • -6
    • +6
    ./security-procs.tcl
  2. … 10 more files in changeset.
Thursday 13 Sep 2018
8:20 am

gustafn

fix for redirect-to-secure, when SuppressHttpPort is set

This changes as well:

- improve symmetry security::get_insecure_location and security::get_secure_location

- add regression test to cover basic cases

- bumb version number of acs-tcl to 5.10.0d19

Options
    • -11
    • +38
    ./security-procs.tcl
  2. … 2 more files in changeset.
Wednesday 12 Sep 2018
10:30 am

gustafn

bug fix: Do not return a location with a port, when SuppressHttpPort is set

for details, see: https://openacs.org/forums/message-view?message_id=5399931

Options
    • -2
    • +9
    ./security-procs.tcl
Tuesday 24 Jul 2018
9:42 pm

gustafn

improve spelling

Options
    • -2
    • +7
    ./security-procs.tcl
  2. … 2 more files in changeset.
Sunday 01 Jul 2018
12:04 am

hectorr

Fix proc and contract doc elements, so they are properly parsed by apidoc::api_*_documentation.

- @parameter -> @param

- @params -> @param

- Add missing @param

- @cvs -> @cvs-id

- @version -> @cvs-id

Options
    • -3
    • +3
    ./security-procs.tcl
  2. … 12 more files in changeset.
Tuesday 26 Jun 2018
10:39 am

gustafn

reduce verbosity

Options
    • -2
    • +2
    ./security-procs.tcl
Saturday 23 Jun 2018
7:16 pm

gustafn

switch back to previous code based on sec_generate_session_id_cookie to fix persistent logins

Options
    • -3
    • +10
    ./security-procs.tcl
Thursday 14 Jun 2018
10:46 am

gustafn

make code more robust, when connection is already closed

Options
    • -1
    • +2
    ./security-procs.tcl
Friday 08 Jun 2018
4:01 pm

hectorr

Wording

Options
    • -3
    • +3
    ./security-procs.tcl