• last updated 9 hours ago
Constraints
Constraints: committers
 
Constraints: files
Constraints: dates
Test the behavior of the file-storage when a malicious user would try to store a pre-existing file on the server as its own

The fix for the file-storage is a simple validation to make sure that the tmpfile exists, however, for the generic case of the file widget, we cannot trust the tmpfile value when this was not generated by the server. This will probably cause regression when one wants to show a "preview" of a form, to be continued.

  1. … 2 more files in changeset.
Incorporate feedback from downstream penetration tests:

do not skip basic validation in the file widget when a tmpfile is not found in the request.

extended adp:icon handling

Added support for multiple classes,

Added more potentially reusabel icon names,

bumped version to 5.10.1d13

  1. … 1 more file in changeset.
extended generic names by "user" and "list-alt"

whitespace changes

added new generic icon name: add-new-item

prefer parameter::get_from_package_key over fetching package_id first

fix false positive of regression test

removed code factored out to the separate "captcha" package

  1. … 10 more files in changeset.
improve comments, such that is is clear what command to use instead

deactivate captcha test for the time being

Constrain captcha width to 100% of its parent's size

whitespace changes

reduce useless warnings for template::adp_parse_tags

The problem was that template::adp_compile_chunk produces no output, when the parsed chunk contains only whitespace,

causing an error message in this case. The changed method shortcuts the behavior.

Fix missing variable

Fix typo

Provide an alternative exec-free captcha implementation using libgd and its Tcl wrapper https://github.com/flightaware/tcl.gd

This implementation will be preferred to the one using convert, when available.

  1. … 1 more file in changeset.
Cleanup dummy commands and objects to avoid cross interactions between tests

  1. … 1 more file in changeset.
Go back supporting arbitrary options, potentially from custom user-defined widgets: these will be assumed to be expressed as name-value pairs and we will keep notifying such cases in the logfile

whitespace changes

revive delete regression test (was formerly in xowiki)

Keep supporting also the htmlarea_p option

Fix doc

Keep handling also the section option

Keep recognizing "format" template::element property, which was never documented

completed generic icon tables

added filetype-csv to generic icon names

  1. … 1 more file in changeset.
reduce verbosity and inprove spelling

Added support for fa-icons to the generic names for adp:icon

Added new options "iconset" and "alt" to adp:icon, updated

documentation in API browser

Bumped version to 5.10.1d9

  1. … 1 more file in changeset.
Generalized ADP compilation caching, simplified handling of ad_init

Generalized adp-compilation caching

* since the result of ADP compilation can depend on the icon set

(and maybe more factors in the future), and the icon set

can be switched freely, either one needs more ADP compilation

at runtime (page rendering time) or caching had to be generalized.

* generalization of caching leads to better scalability, and

since the number of icon sets concurrently active at one

site is limited, this option seems favorable.

* The only potential incompatibility might be from installations

doing "manual" incantations of "template::adp_init" followed by

direct calls of the stub. The only packages (out of the 365

packages in CVS) effected by this are "diagram" and

"workflow". Both have been fixed in the repository. This

incantation can be simplified as followed.

Simplified handling of adp_init

* old:

template::adp_init adp $file_stub

template::code::adp::$file_stub

* new

[template::adp_init adp $file_stub]

Bumped version to 5.10.1d8

  1. … 1 more file in changeset.