Ticket search results

CWE-200 and CWE-862 Information exposure via search

Kenton Taylor — Thu, 03 Sep 2026 16:52:56 -0000

drop other urllib handlers

Dave Brondsema — Thu, 03 Sep 2026 16:52:50 -0000

Fix git rename handling

Dave Brondsema — Thu, 03 Sep 2026 16:44:15 -0000

html sanitization fixes, drop inline SVG tag support

Dave Brondsema — Thu, 03 Sep 2026 16:52:53 -0000

Implement field level encryption for User tool data fields

Carlos Cruz — Thu, 10 Sep 2026 15:16:08 -0000

Field level encryption for the following attributes in the User's tool data field - tool_data.sfx.registration_ip - tool_data.sfx.registration_rdns - tool_data.sfx.normalized_email - tool_data.temp_reg_fields.phone_ext

Align REST checks/queries with web controllers

Dave Brondsema — Mon, 24 Aug 2026 16:03:39 -0000

Upgrade packages

Dave Brondsema — Mon, 24 Aug 2026 15:29:14 -0000

Implement field level encryption for more user fields

Carlos Cruz — Mon, 24 Aug 2026 15:29:14 -0000

The scope of this ticket includes the following user fields: - UserLoginDetails: - ip - User: - last_access.session_ip - last_access.login_ip - socialnetworks.urls - telnumbers

Implement field level encryption for email address in user preferences

Carlos Cruz — Mon, 24 Aug 2026 15:29:14 -0000

Documentation and migration for encrypted fields

Dave Brondsema — Mon, 29 Jun 2026 17:19:08 -0000

With all the new field-level encryption lately, we need to update our docs, configs, and migrations

Implement field level encryption for User's email addresses list

Carlos Cruz — Mon, 24 Aug 2026 15:29:14 -0000

Authentication code tweaks

Guillermo Cruz — Mon, 29 Jun 2026 17:19:08 -0000

If geo information is available make it available for the html template.

Pin pre-commit dependencies

Guillermo Cruz — Mon, 29 Jun 2026 17:19:08 -0000

Implement field level encryption for the email field from the EmailAddress model

Carlos Cruz — Mon, 29 Jun 2026 17:19:08 -0000

Implement field level encryption for the email field in the EmailAddress model

Remove locale en_US.UTF-8 dependency

Dillon Walls — Mon, 29 Jun 2026 17:19:08 -0000

More modern versions of python handle UTF-8 encoding perfectly with the default univervisal `C.UTF-8` encoding. The hard-coded `en_US.UTF-8` that's used by svn.py isn't necessary anymore.

Implement field level encryption for the User's display name

Carlos Cruz — Mon, 29 Jun 2026 17:19:08 -0000

Implement field level encryption for the User's display name and update related tests

tweak show domain on external links

Dillon Walls — Mon, 29 Jun 2026 17:19:08 -0000

email auth verification by link

Dave Brondsema — Mon, 29 Jun 2026 17:19:08 -0000

With a link we can have a longer token for more security (still type-able if needed). And the link will defeat some MITM phishing attacks, forcing you to the right site. We can apply this to 2FA accounts too (currently being skipped) so they get the MITM protections too Downside is if you don't have email access on the same computer you're logging in to :(

Python Packages Upgrade

Daniel Castillo — Mon, 29 Jun 2026 17:19:08 -0000

Upgrade Python packages to the latest versions.

show domain on external links, if misleading

Dave Brondsema — Mon, 29 Jun 2026 17:19:08 -0000

When showing links (e.g originating from markdown, but really any html output) we should do something about links that could be misleading. For example with `sourceforge.net/auth/` we could automatically append `(evil.com)` into the output so its obvious when its misleading. We should also check for non-ascii domain names (IDN) and if they have chars that are potentially confusing with normal ascii, then show the decoded domain name (even if the link & text match, if the chars could be confusing)

Upgrade Underscore Library

Dillon Walls — Mon, 29 Jun 2026 17:19:08 -0000

Upgrade from 1.13.6 -> 1.13.8 to protect against known vulnerability https://github.com/jashkenas/underscore/issues/3011

improve bad markdown performance

Dave Brondsema — Mon, 29 Jun 2026 17:19:08 -0000

In some very specific cases the performance of markdown can be quite bad

Escape specific values in notification emails

Guillermo Cruz — Mon, 29 Jun 2026 17:19:08 -0000

We send out notification emails when a user performs an action, we should escape some of the values including in these emails like usernames.