Activity for Apache Allura™
-
Guillermo Cruz committed [f6b0f4] on Git
[#8623] bound the easywidgets resource cache and cap _slim requests
-
[#8623] keep inline script/style bodies raw under easywidgets autoescaping
-
security fixes: turn on autoescaping for widgets, fix tracker select XSS
-
XSS security fix
-
security fixes: turn on autoescaping for widgets, fix tracker select XSS
-
Dave Brondsema committed [98bc2a] on Git
[#8619] test for text_contains_hostname substring bypass
-
[#8619] test for class/id sanitization on void elements
-
[#8619] test for iframe body mXSS via math/svg reparse
-
[#8619] test for SVG blocked, MathML allowed
-
[#8619] test for iframe followed by script
-
[#8621] test for FTP redirect bypassing internal-host protection
-
Implement field level encryption for User tool data fields
-
fix git thread-safety issues
-
fix on db/8618-cat-file Ended up being re-use after streaming, in same thread, not different threads
-
[#8618] harden rev_parse() against git's relative-ref syntax
-
[#8618] read git blob content via a one-off subprocess, not the shared cat-file pipe
-
Carlos Cruz committed [c62dd7] on Git
[#8617] Cover encrypted-only tool data reads and cleanup
-
[#8617] Update User's set_tool_data to store encrypted tool data values
-
add to SECURITY.md
-
fixup! [#8617] Cover encrypted-only tool data reads and cleanup
-
fixup! [#8617] Update User's set_tool_data to store encrypted tool data values
-
1.21.0 news
-
publicize CVEs in 1.21.0
-
CWE-200 and CWE-862 Information exposure via search
-
html sanitization fixes, drop inline SVG tag support
-
drop other urllib handlers
-
Home
-
fixup! [#8617] Update User's set_tool_data to store encrypted tool data values
-
optimize _get_site_notification in case of users with many projects
-
[#6054] inbound sender authentication
-
fixup! [#6054] Simplify inbound sender authentication parsing
-
[#8617] Cover encrypted-only tool data reads and cleanup
-
fixup! [#8617] Update User's set_tool_data to store encrypted tool data values
-
[#8617] Update User's set_tool_data to store encrypted tool data values
-
[#8617] Update tool-data encryption flags and generic tests
-
fixup! [#8617] Update User's set_tool_data to store encrypted tool data values
-
CHANGES updated for ASF release 1.21.0
-
strengthen _verify_return_to and tests for webob upgrade
-
bumping webob 1.8.10 -> 1.8.11
-
update discussion thread logic for consistency
-
add license to SECURITY.md
-
retry test_markdown_many_bad_links a few times to avoid false-positive failures
-
start a SECURITY.md
-
increase ulimits on docker web to avoid "Too many open files" during test runs at least
-
Daniel Castillo committed [534a0b] on Git
Fix: Force push tests
-
[#11714] more Permissions-Policy values drop Feature-policy
-
turn on scm.force_push.git.enabled by default
-
[#8622] Rework search result filtering
-
CWE-200 and CWE-862
-
Kenton Taylor committed [651b3b] on Git
[#8622] Rework search result filtering
-
CWE-200 and CWE-862
-
[#12049] Fix for sync repo config command
-
drop other urllib handlers
-
change lgtm
-
Fix git rename handling
-
changes look good and tests pass
-
html sanitization fixes, drop inline SVG tag support
-
changes look good and tests pass
-
[#8621] drop ftp/file/data url handlers
-
[#8620] fix space handling in renamed files
-
html sanitization fixes, drop inline SVG tag support
-
[#8619] invalidate markdown caches
-
[#8619] fix text_contains_hostname substring bypass
-
[#8619] sanitize class/id on void elements too
-
[#8619] drop allowed iframe's body
-
[#8619] block SVG entirely, keep MathML
-
[#8619] iframe tracking better
-
[#8621] drop ftp/file/data url handlers
-
[#8620] fix space handling in renamed files
-
drop other urllib handlers
-
Fix git rename handling
-
html sanitization fixes
-
fix git thread-safety issues
-
fix git thread-safety issues
-
Add mongodb option for the jinja bytecode cache
-
[#8617] Implement field level encryption for tool data fields
-
[#12049] Fix for sync repo config command
-
Prevent re-tracking revoked sessions
-
generate html
-
version 1.20.0
-
fix typos
-
publicize security fix
-
Align REST checks/queries with web controllers
-
Home
-
Prevent re-tracking revoked sessions
-
Fix for CHANGES version
-
Added migrations instructions to changes, plus some fixes
-
New script to backfill allow forcepush flag
-
Fix for force push on new repos
-
Added scm.force_push.git.enabled flag
-
Force push enable of repos
-
fixup! Add mongodb option for the jinja bytecode cache
-
[#8617] Update User's set_tool_data to store encrypted tool data values
-
[#6054] Simplify trusted MX header verification
-
[#6054] Verify inbound senders with trusted MX header
-
[#6054] Simplify inbound sender authentication parsing
-
Implement field level encryption for User tool data fields
-
Added migrations instructions to changes, plus some fixes
-
Add mongodb option for the jinja bytecode cache