https://forge-allura.apache.org/p/allura/tickets/You searched for assigned_to:"brondsem"enMon, 21 Sep 2026 14:25:02 -0000https://forge-allura.apache.org/p/allura/tickets/8621/Dave BrondsemaThu, 03 Sep 2026 16:52:50 -0000https://forge-allura.apache.org/p/allura/tickets/8621/https://forge-allura.apache.org/p/allura/tickets/8620/Dave BrondsemaThu, 03 Sep 2026 16:44:15 -0000https://forge-allura.apache.org/p/allura/tickets/8620/https://forge-allura.apache.org/p/allura/tickets/8619/Dave BrondsemaThu, 03 Sep 2026 16:52:53 -0000https://forge-allura.apache.org/p/allura/tickets/8619/https://forge-allura.apache.org/p/allura/tickets/8618/Got this when we were taking a lots of simultaneous requests. Weird error showing template code from a repo, where a SHA was expected. ``` File '/var/local/allura/Allura/allura/controllers/repository.py', line 906 in index return self.raw() File '/var/local/allura/Allura/allura/controllers/repository.py', line 942 in raw return iter(self._blob) File '/var/local/allura/Allura/allura/model/repository.py', line 1615 in __iter__ return iter(self.open()) File '/var/local/allura/Allura/allura/model/repository.py', line 1612 in open return self.repo.open_blob(self) File '/var/local/allura/Allura/allura/model/repository.py', line 487 in open_blob return self._impl.open_blob(blob) File '/var/local/allura/ForgeGit/forgegit/model/git_repo.py', line 500 in open_blob self._object(blob._id).data_stream) File '/var/local/env-allura/lib/python3.11/site-packages/git/objects/base.py', line 201 in data_stream return self.repo.odb.stream(self.binsha) File '/var/local/env-allura/lib/python3.11/site-packages/git/db.py', line 50 in stream hexsha, typename, size, stream = self._git.stream_object_data(bin_to_hex(binsha)) File '/var/local/env-allura/lib/python3.11/site-packages/git/cmd.py', line 1896 in stream_object_data hexsha, typename, size = self.__get_object_header(cmd, ref) File '/var/local/env-allura/lib/python3.11/site-packages/git/cmd.py', line 1853 in __get_object_header return self._parse_object_header(cmd.stdout.readline()) File '/var/local/env-allura/lib/python3.11/site-packages/git/cmd.py', line 1814 in _parse_object_header raise ValueError("SHA %s could not be resolved, git returned: %r" % (tokens[0], header_line.strip())) ValueError: SHA b'{%' could not be resolved, git returned: b'{% extends g.theme.master %}' ```Dave BrondsemaMon, 21 Sep 2026 14:25:02 -0000https://forge-allura.apache.org/p/allura/tickets/8618/https://forge-allura.apache.org/p/allura/tickets/8616/Dave BrondsemaMon, 24 Aug 2026 16:03:39 -0000https://forge-allura.apache.org/p/allura/tickets/8616/https://forge-allura.apache.org/p/allura/tickets/8615/Dave BrondsemaMon, 24 Aug 2026 15:29:14 -0000https://forge-allura.apache.org/p/allura/tickets/8615/https://forge-allura.apache.org/p/allura/tickets/8611/With all the new field-level encryption lately, we need to update our docs, configs, and migrationsDave BrondsemaMon, 29 Jun 2026 17:19:08 -0000https://forge-allura.apache.org/p/allura/tickets/8611/https://forge-allura.apache.org/p/allura/tickets/8601/With a link we can have a longer token for more security (still type-able if needed). And the link will defeat some MITM phishing attacks, forcing you to the right site. We can apply this to 2FA accounts too (currently being skipped) so they get the MITM protections too Downside is if you don't have email access on the same computer you're logging in to :(Dave BrondsemaMon, 29 Jun 2026 17:19:08 -0000https://forge-allura.apache.org/p/allura/tickets/8601/https://forge-allura.apache.org/p/allura/tickets/8599/When showing links (e.g originating from markdown, but really any html output) we should do something about links that could be misleading. For example with `<a href=https://evil.com/>sourceforge.net/auth/</a>` we could automatically append `(evil.com)` into the output so its obvious when its misleading. We should also check for non-ascii domain names (IDN) and if they have chars that are potentially confusing with normal ascii, then show the decoded domain name (even if the link & text match, if the chars could be confusing)Dave BrondsemaMon, 29 Jun 2026 17:19:08 -0000https://forge-allura.apache.org/p/allura/tickets/8599/https://forge-allura.apache.org/p/allura/tickets/8597/In some very specific cases the performance of markdown can be quite badDave BrondsemaMon, 29 Jun 2026 17:19:08 -0000https://forge-allura.apache.org/p/allura/tickets/8597/https://forge-allura.apache.org/p/allura/tickets/8589/After [#8588] we should be able to support python 3.14 I thinkDave BrondsemaMon, 29 Jun 2026 17:19:08 -0000https://forge-allura.apache.org/p/allura/tickets/8589/https://forge-allura.apache.org/p/allura/tickets/8588/`regex-as-re-globally` is a very hacky package (I made it, I'm ok to admit it) and it continuously has needs more fixes for every new version of python https://github.com/brondsem/regex-as-re-globally/issues?q=is%3Aissue So lets fix our regexes so we don't need itDave BrondsemaMon, 29 Jun 2026 17:19:08 -0000https://forge-allura.apache.org/p/allura/tickets/8588/https://forge-allura.apache.org/p/allura/tickets/8576/To get compliant with https://retirejs.github.io/retire.js/ vulnerability scanningDave BrondsemaTue, 12 Aug 2025 17:44:01 -0000https://forge-allura.apache.org/p/allura/tickets/8576/https://forge-allura.apache.org/p/allura/tickets/8572/Dave BrondsemaTue, 12 Aug 2025 17:44:00 -0000https://forge-allura.apache.org/p/allura/tickets/8572/https://forge-allura.apache.org/p/allura/tickets/8568/Dave BrondsemaTue, 12 Aug 2025 17:43:59 -0000https://forge-allura.apache.org/p/allura/tickets/8568/https://forge-allura.apache.org/p/allura/tickets/8566/our LDAP plugin's password handling uses `crypt` which is deprecated since 3.11 and removed in 3.13 https://docs.python.org/3/library/crypt.html crypt only supports a few algorithms anyway, it'd be good to support argon2, scrypt, bcrypt, pbkdf2_sha512 local password storage does sha256 and definitely should be updated. Similar/same config options for local & ldap hashing? https://passlib.readthedocs.io/en/stable/ seems pretty good and supports a lot of algorithms, but it isn't maintained the best :( If an admin configures a new password hashing algorithm, we should make it be a seamless transition, including when someone logs in to re-hash the password, when needed.Dave BrondsemaTue, 12 Aug 2025 17:43:59 -0000https://forge-allura.apache.org/p/allura/tickets/8566/https://forge-allura.apache.org/p/allura/tickets/8555/If a user is blocked at the tool level, they still may be able to post in discussion forums that have additional ACLs. E.g. a forum within the discussion tool, which has anonymous posting allowed, or has developer only posting.Dave BrondsemaMon, 10 Jun 2024 15:31:45 -0000https://forge-allura.apache.org/p/allura/tickets/8555/https://forge-allura.apache.org/p/allura/tickets/8540/The "Recently Updated" sort option on wiki's Browse Pages does not work correctly. It does the query and then applies a sort afterwards. So if you have more than one page of results, it only sorts within the current page not the whole set of pages.Dave BrondsemaMon, 10 Jun 2024 15:31:45 -0000https://forge-allura.apache.org/p/allura/tickets/8540/https://forge-allura.apache.org/p/allura/tickets/8539/https://docs.astral.sh/ruff/rules/#flake8-bandit-s in particular would be good, some others tooDave BrondsemaMon, 10 Jun 2024 15:31:45 -0000https://forge-allura.apache.org/p/allura/tickets/8539/https://forge-allura.apache.org/p/allura/tickets/8536/- `Markup()` objects can use `%` or `.format` to automatically escape things into them, that's nicer - `|safe` in templates is not ideal, better to use Markup() right when the string is constructed and known to be safe html.Dave BrondsemaMon, 10 Jun 2024 15:31:45 -0000https://forge-allura.apache.org/p/allura/tickets/8536/https://forge-allura.apache.org/p/allura/tickets/8534/Our repo gets mirrored to https://github.com/apache/allura/ so we can set up CodeQL to run there and check for security issues in codeDave BrondsemaMon, 10 Jun 2024 15:31:45 -0000https://forge-allura.apache.org/p/allura/tickets/8534/