<!DOCTYPE html>
<html>
<head>
</head>
<body style='font: 12pt Roboto, "DejaVu Sans", Arial; margin-left: 5px; margin-right: 5px;'>
<div id="entry">
<h1 style='font: 12pt Roboto, "DejaVu Sans", Arial; display:block; background: #c0cf88; border-bottom: solid 3px #573; padding: 5px; margin-top: 0px; color: #573;'><a href="https://kallithea-scm.org/repos/kallithea/changeset/959a9fa7d1a1c1ca422f2ccc7a721569245ad241" style="text-decoration: none; font-weight: bold; color: #573;">controllers: remove old auth_token checks - it was only partial CSRF protection</a></h1>
<div id="body">
kiilerix committed on 2015-03-27 15:25:27<br />branch: default<br />changeset: <a href="https://kallithea-scm.org/repos/kallithea/changeset/959a9fa7d1a1c1ca422f2ccc7a721569245ad241">959a9fa7</a><pre>controllers: remove old auth_token checks - it was only partial CSRF protection
M kallithea/controllers/admin/repos.py (11 lines added, 18 lines removed)
M kallithea/controllers/journal.py (20 lines added, 25 lines removed)
M kallithea/lib/helpers.py (0 lines added, 17 lines removed)
M kallithea/public/js/base.js (3 lines added, 7 lines removed)
M kallithea/templates/admin/repos/repo_edit_advanced.html (0 lines added, 1 lines removed)
M kallithea/templates/base/base.html (1 lines added, 1 lines removed)
M kallithea/templates/data_table/_dt_elements.html (1 lines added, 1 lines removed)
M kallithea/templates/summary/summary.html (1 lines added, 1 lines removed)
M kallithea/tests/functional/test_journal.py (1 lines added, 2 lines removed)</pre>
</div>
</div>
</div>
</body>
</html>
<!DOCTYPE html>
<html>
<head>
</head>
<body style='font: 12pt Roboto, "DejaVu Sans", Arial; margin-left: 5px; margin-right: 5px;'>
<div id="entry">
<h1 style='font: 12pt Roboto, "DejaVu Sans", Arial; display:block; background: #c0cf88; border-bottom: solid 3px #573; padding: 5px; margin-top: 0px; color: #573;'><a href="https://kallithea-scm.org/repos/kallithea/changeset/aef21d16a262b8b5aecd33af79b6aef05a18c4a4" style="text-decoration: none; font-weight: bold; color: #573;">forms: use secure_form to add authentication token to all html forms Towards CSRF protection ... but not yet checked</a></h1>
<div id="body">
kiilerix committed on 2015-03-27 15:25:27<br />branch: default<br />changeset: <a href="https://kallithea-scm.org/repos/kallithea/changeset/aef21d16a262b8b5aecd33af79b6aef05a18c4a4">aef21d16</a><pre>forms: use secure_form to add authentication token to all html forms
Towards CSRF protection ... but not yet checked
M kallithea/lib/helpers.py (2 lines added, 2 lines removed)</pre>
</div>
</div>
</div>
</body>
</html>
<!DOCTYPE html>
<html>
<head>
</head>
<body style='font: 12pt Roboto, "DejaVu Sans", Arial; margin-left: 5px; margin-right: 5px;'>
<div id="entry">
<h1 style='font: 12pt Roboto, "DejaVu Sans", Arial; display:block; background: #c0cf88; border-bottom: solid 3px #573; padding: 5px; margin-top: 0px; color: #573;'><a href="https://kallithea-scm.org/repos/kallithea/changeset/569199be3475adc708a8f33b6660405113b816ed" style="text-decoration: none; font-weight: bold; color: #573;">javascript: provide secure_form compatible_authentication_token in all AJAX POSTs _authentication_token is introduced as a global javascript variable. That ...</a></h1>
<div id="body">
kiilerix committed on 2015-04-07 01:30:05<br />branch: default<br />changeset: <a href="https://kallithea-scm.org/repos/kallithea/changeset/569199be3475adc708a8f33b6660405113b816ed">569199be</a><pre>javascript: provide secure_form compatible_authentication_token in all AJAX POSTs
_authentication_token is introduced as a global javascript variable. That seems
less ugly than passing it through as parameter everywhere ... and the token
really _is_ a global thing.
M kallithea/lib/helpers.py (1 lines added, 1 lines removed)
M kallithea/public/js/base.js (3 lines added, 1 lines removed)
M kallithea/templates/base/root.html (2 lines added, 0 lines removed)</pre>
</div>
</div>
</div>
</body>
</html>
<!DOCTYPE html>
<html>
<head>
</head>
<body style='font: 12pt Roboto, "DejaVu Sans", Arial; margin-left: 5px; margin-right: 5px;'>
<div id="entry">
<h1 style='font: 12pt Roboto, "DejaVu Sans", Arial; display:block; background: #c0cf88; border-bottom: solid 3px #573; padding: 5px; margin-top: 0px; color: #573;'><a href="https://kallithea-scm.org/repos/kallithea/changeset/0efca3ad8467debcf23dbdf9b4c50041f05d6c06" style="text-decoration: none; font-weight: bold; color: #573;">tests: provide _authentication_token when POSTing So far not used, just preparing for the the time when the actual checking is introduced ... This change i...</a></h1>
<div id="body">
kiilerix committed on 2015-04-07 01:30:05<br />branch: default<br />changeset: <a href="https://kallithea-scm.org/repos/kallithea/changeset/0efca3ad8467debcf23dbdf9b4c50041f05d6c06">0efca3ad</a><pre>tests: provide _authentication_token when POSTing
So far not used, just preparing for the the time when the actual checking is
introduced ...
This change is very verbose. self.app.post should perhaps just at this value
automagically ...
M kallithea/config/routing.py (1 lines added, 0 lines removed)
M kallithea/controllers/login.py (8 lines added, 0 lines removed)
M kallithea/tests/__init__.py (3 lines added, 0 lines removed)
M kallithea/tests/functional/test_admin_auth_settings.py (1 lines added, 1 lines removed)
M kallithea/tests/functional/test_admin_defaults.py (7 lines added, 2 lines removed)
M kallithea/tests/functional/test_admin_gists.py (10 lines added, 5 lines removed)
M kallithea/tests/functional/test_admin_permissions.py (4 lines added, 2 lines removed)
M kallithea/tests/functional/test_admin_repos.py (35 lines added, 19 lines removed)
M kallithea/tests/functional/test_admin_settings.py (10 lines added, 3 lines removed)
M kallithea/tests/functional/test_admin_user_groups.py (13 lines added, 9 lines removed)
M kallithea/tests/functional/test_admin_users.py (18 lines added, 12 lines removed)
M kallithea/tests/functional/test_changeset_comments.py (4 lines added, 4 lines removed)
M kallithea/tests/functional/test_files.py (36 lines added, 16 lines removed)
M kallithea/tests/functional/test_forks.py (7 lines added, 4 lines removed)
M kallithea/tests/functional/test_my_account.py (13 lines added, 9 lines removed)</pre>
</div>
</div>
</div>
</body>
</html>
<!DOCTYPE html>
<html>
<head>
</head>
<body style='font: 12pt Roboto, "DejaVu Sans", Arial; margin-left: 5px; margin-right: 5px;'>
<div id="entry">
<h1 style='font: 12pt Roboto, "DejaVu Sans", Arial; display:block; background: #c0cf88; border-bottom: solid 3px #573; padding: 5px; margin-top: 0px; color: #573;'><a href="https://kallithea-scm.org/repos/kallithea/changeset/ae947de541d5630e5505c7c8ded05cd37c7f232b" style="text-decoration: none; font-weight: bold; color: #573;">auth: check CSRF protection token when authenticating Use pylons secure_form to get CSRF protection on all authenticated POSTs. This fixes CVE-2015-0276. G...</a></h1>
<div id="body">
kiilerix committed on 2015-04-07 01:30:05<br />branch: default<br />changeset: <a href="https://kallithea-scm.org/repos/kallithea/changeset/ae947de541d5630e5505c7c8ded05cd37c7f232b">ae947de5</a><pre>auth: check CSRF protection token when authenticating
Use pylons secure_form to get CSRF protection on all authenticated POSTs. This
fixes CVE-2015-0276.
GETs should not have any side effects and do thus not need CSRF protection.
Reported by Paul van Empelen.
M kallithea/lib/auth.py (8 lines added, 0 lines removed)</pre>
</div>
</div>
</div>
</body>
</html>
<!DOCTYPE html>
<html>
<head>
</head>
<body style='font: 12pt Roboto, "DejaVu Sans", Arial; margin-left: 5px; margin-right: 5px;'>
<div id="entry">
<h1 style='font: 12pt Roboto, "DejaVu Sans", Arial; display:block; background: #c0cf88; border-bottom: solid 3px #573; padding: 5px; margin-top: 0px; color: #573;'><a href="https://kallithea-scm.org/repos/kallithea/changeset/ad0ce803b40cb17fc3988373052943e041030b02" style="text-decoration: none; font-weight: bold; color: #573;">release: 0.2 on stable branch</a></h1>
<div id="body">
kiilerix committed on 2015-04-10 17:02:11<br />branch: stable<br />tag: 0.2<br />changeset: <a href="https://kallithea-scm.org/repos/kallithea/changeset/ad0ce803b40cb17fc3988373052943e041030b02">ad0ce803</a><pre>release: 0.2 on stable branch
M kallithea/__init__.py (1 lines added, 1 lines removed)</pre>
</div>
</div>
</div>
</body>
</html>
<!DOCTYPE html>
<html>
<head>
</head>
<body style='font: 12pt Roboto, "DejaVu Sans", Arial; margin-left: 5px; margin-right: 5px;'>
<div id="entry">
<h1 style='font: 12pt Roboto, "DejaVu Sans", Arial; display:block; background: #c0cf88; border-bottom: solid 3px #573; padding: 5px; margin-top: 0px; color: #573;'><a href="https://kallithea-scm.org/repos/kallithea/changeset/6eb57b4f311b4ab30eb3acfa83f6729d200dcebe" style="text-decoration: none; font-weight: bold; color: #573;">Added tag 0.2 for changeset ad0ce803b40c</a></h1>
<div id="body">
kiilerix committed on 2015-04-10 17:09:40<br />branch: stable<br />tag: tip<br />changeset: <a href="https://kallithea-scm.org/repos/kallithea/changeset/6eb57b4f311b4ab30eb3acfa83f6729d200dcebe">6eb57b4f</a><pre>Added tag 0.2 for changeset ad0ce803b40c
M .hgtags (1 lines added, 0 lines removed)</pre>
</div>
</div>
</div>
</body>
</html>