#4208 Change default neighborhood "Home" app to Wiki

v1.0.0
closed
nobody
General
2015-08-20
2012-05-16
Cory Johns
No

Because of the potential security issues raised by allowing arbitrary custom HTML and CSS in the default neighborhood Home app, we need to switch to using the Wiki.

Change neighborhood creation to not install the Home app, and create a script to manually install it from the command line for a particular neighborhood.

Related

Tickets: #4208
Tickets: #4209
Tickets: #4210

Discussion

  • Dave Brondsema

    Dave Brondsema - 2012-05-16
    • labels: --> 42cc
    • milestone: limbo --> forge-backlog
     
  • Yaroslav Luzin

    Yaroslav Luzin - 2012-05-17

    Created ticket #54: [#4208] Change default neighborhood "Home" app to Wiki (2cp)

     

    Related

    Tickets: #4208

  • Anonymous - 2012-05-17

    Originally by: tramadolmen

    Home application deeply integrated in neighborhood. In other words it is --init-- project when neighborhood is created. I can add field to neighborhood that can hide\show "Home" page and redirect all requests to wiki page if "Home" was hide. Ok?

     
  • Anonymous - 2012-05-17

    Originally by: tramadolmen

    I have added this field. Maybe you will receive soon updates with this ticket

     
  • Yaroslav Luzin

    Yaroslav Luzin - 2012-05-17

    closed #54 and pushed changes into 42cc_4208, it also contains a few necessary commits from #56 42cc_4197, so please check this after [#4197]

    • status: open --> code-review
     

    Related

    Tickets: #4197

  • Dave Brondsema

    Dave Brondsema - 2012-05-18
    • labels: 42cc --> 42cc, nbhd home
     
  • Dave Brondsema

    Dave Brondsema - 2012-05-21
    • status: code-review --> open
     
  • Dave Brondsema

    Dave Brondsema - 2012-05-21

    Actually I would like to go through and do everything needed to make a neighborhood not have the Home app at all, for new neighborhoods. I don't know all the places that the Home app is mentioned, but here are some thoughts:

    • in Allura/allura/model/project.py where if self == self.neighborhood.neighborhood_project references the Home tool, that can be removed. Instead, change the Home tool to show up in the top nav naturally (it is some setting in ProjectHomeApp.
    • the "Home Content (HTML)" form on the neighborhood /_admin/overview should disappear if the app is not installed
    • more... ? I'm sure there are some more. Let us know if you have questions or problems as you work on it
     
  • Yaroslav Luzin

    Yaroslav Luzin - 2012-05-22

    Created #65: [#4208] Completely remove Home tool from a neighborhood (3cp)

     

    Related

    Tickets: #4208

  • Dave Brondsema

    Dave Brondsema - 2012-05-22

    On the admin overview form there are 2 other options that might be affected (or not):

    • "Redirect" this functionality needs to still work, even without the Home app.
    • "Allow Browsing". This is not really used anywhere, so if it only works when the home app is installed, that is ok.
     
  • Yaroslav Luzin

    Yaroslav Luzin - 2012-05-30

    closed #65, changes in 42cc_4208

    • status: open --> code-review
     
  • Dave Brondsema

    Dave Brondsema - 2012-06-11
    • qa: Dave Brondsema
     
  • Dave Brondsema

    Dave Brondsema - 2012-06-14
    • status: code-review --> in-progress
     
  • Dave Brondsema

    Dave Brondsema - 2012-06-14

    Nice progress on this, it's headed in the right direction now. Here's some feedback for further changes:

    • The 'have_home_project' method would be better named 'has_home_tool'. It would also be more pythonic/cleaner for it to be implemented as return self.neighborhood_project.app_config('home') is not None
    • In Allura/allura/controllers/project.py there are these lines: if not self.neighborhood.have_home_project: redirect(c.project.script_name + 'wiki/') I think it'd be better if this index() method just redirected to be first tool, not have a hardcoded reference to wiki. This is how the project's index controller works, so you can re-use the first_mount helper. (The other stuff in the ProjectController index is not necessary)
    • the update-neighborhood command/class would be a little easier to use if it was called something like 'update-neighborhood-home-tool' and had more help text (or an example) so that an administrator knows what to put for the last parameter.
     
  • Yaroslav Luzin

    Yaroslav Luzin - 2012-06-15

    created #87: [#4208] Refactoring and small changes (1cp)

     

    Related

    Tickets: #4208

  • Yaroslav Luzin

    Yaroslav Luzin - 2012-06-19
    • status: in-progress --> code-review
     
  • Yaroslav Luzin

    Yaroslav Luzin - 2012-06-19

    closed #87 and pushed changes into 42cc_4208

     
  • Dave Brondsema

    Dave Brondsema - 2012-06-26
    • status: code-review --> closed
    • milestone: forge-backlog --> forge-jun-29
     

Log in to post a comment.