• last updated 13 hours ago
Constraints
Constraints: committers
 
Constraints: files
Constraints: dates
Shorten idiom

Test template::util::is_nil

Deprecate template::util::array_to_vars and template::util::vars_to_array: their functionality can be easily inlined by using the array command

  1. … 3 more files in changeset.
Declare proc coverage

  1. … 1 more file in changeset.
Make also sure the tmpfile from the widget exists beforehand, when validating: we don't want users to "explore" our tmpdir with bogus values that just look sane

Improve doc

Revert to previous template::widget::file behavior of accepting input in a form of a list of 3 elements (e.g. without a .tmpfile in the request), but introduce validation so that we enforce all widget values to be in the proper format and the files to be "safe"

    • -0
    • +1
    ./catalog/acs-templating.en_US.ISO-8859-1.xml
file file-procs.tcl was initially added on branch oacs-5-10.

    • -0
    • +0
    ./tcl/test/file-procs.tcl
Test the behavior of the file-storage when a malicious user would try to store a pre-existing file on the server as its own

The fix for the file-storage is a simple validation to make sure that the tmpfile exists, however, for the generic case of the file widget, we cannot trust the tmpfile value when this was not generated by the server. This will probably cause regression when one wants to show a "preview" of a form, to be continued.

  1. … 2 more files in changeset.
Incorporate feedback from downstream penetration tests:

do not skip basic validation in the file widget when a tmpfile is not found in the request.

extended adp:icon handling

Added support for multiple classes,

Added more potentially reusabel icon names,

bumped version to 5.10.1d13

extended generic names by "user" and "list-alt"

whitespace changes

added new generic icon name: add-new-item

prefer parameter::get_from_package_key over fetching package_id first

Cleanup message keys that do not exist in the english locale (they do exist in their "_time" variant, e.g. Time_must_be_after_min_time, already translated in spanish)

    • -2
    • +0
    ./catalog/acs-templating.es_ES.ISO-8859-1.xml
Bump version number after catalog change

fix false positive of regression test

removed code factored out to the separate "captcha" package

    • -2
    • +0
    ./catalog/acs-templating.de_DE.ISO-8859-1.xml
    • -2
    • +0
    ./catalog/acs-templating.en_US.ISO-8859-1.xml
    • -2
    • +0
    ./catalog/acs-templating.it_IT.ISO-8859-1.xml
    • -906
    • +0
    ./resources/fonts/LiberationSans-Regular.ttf
    • -2
    • +1
    ./sql/oracle/acs-templating-create.sql
    • -13
    • +0
    ./sql/oracle/upgrade/upgrade-5.10.1d0-5.10.1d1.sql
    • -2
    • +1
    ./sql/postgresql/acs-templating-create.sql
    • -10
    • +0
    ./sql/postgresql/captcha-create.sql
improve comments, such that is is clear what command to use instead

deactivate captcha test for the time being

Constrain captcha width to 100% of its parent's size

whitespace changes

reduce useless warnings for template::adp_parse_tags

The problem was that template::adp_compile_chunk produces no output, when the parsed chunk contains only whitespace,

causing an error message in this case. The changed method shortcuts the behavior.

Fix missing variable

Fix typo

Provide an alternative exec-free captcha implementation using libgd and its Tcl wrapper https://github.com/flightaware/tcl.gd

This implementation will be preferred to the one using convert, when available.

    • -0
    • +906
    ./resources/fonts/LiberationSans-Regular.ttf
file LiberationSans-Regular.ttf was initially added on branch oacs-5-10.

    • -0
    • +0
    ./resources/fonts/LiberationSans-Regular.ttf
passing properties consistently with @....;literal@

    • -1
    • +1
    ./www/doc/exercise/list-and-var-sample.adp
  1. … 52 more files in changeset.
passing properties consistently with @....;literal@ and not "noquote", since noquote content is already parsed

  1. … 13 more files in changeset.