<!DOCTYPE html>
<html>
<head>
</head>
<body style='font: 12pt Roboto, "DejaVu Sans", Arial; margin-left: 5px; margin-right: 5px;'>
<div id="entry">
<h1 style='font: 12pt Roboto, "DejaVu Sans", Arial; display:block; background: #c0cf88; border-bottom: solid 3px #573; padding: 5px; margin-top: 0px; color: #573;'><a href="https://kallithea-scm.org/repos/kallithea/changeset/d89d586b26ae2ffe1127af1cb5d174adbccbfefa" style="text-decoration: none; font-weight: bold; color: #573;">Merge stable</a></h1>
<div id="body">
kiilerix committed on 2016-12-23 23:34:38<br />branch: default<br />changeset: <a href="https://kallithea-scm.org/repos/kallithea/changeset/d89d586b26ae2ffe1127af1cb5d174adbccbfefa">d89d586b</a><pre>Merge stable
M development.ini (18 lines added, 18 lines removed)
M kallithea/bin/template.ini.mako (19 lines added, 19 lines removed)
M kallithea/config/deployment.ini_tmpl (18 lines added, 18 lines removed)
M kallithea/config/middleware.py (3 lines added, 3 lines removed)
R kallithea/lib/middleware/appenlight.py (5 lines added, 5 lines removed)
M kallithea/tests/test.ini (18 lines added, 18 lines removed)
M scripts/generate-ini.py (1 lines added, 1 lines removed)
M scripts/manifest (1 lines added, 1 lines removed)</pre>
</div>
</div>
</div>
</body>
</html>
<!DOCTYPE html>
<html>
<head>
</head>
<body style='font: 12pt Roboto, "DejaVu Sans", Arial; margin-left: 5px; margin-right: 5px;'>
<div id="entry">
<h1 style='font: 12pt Roboto, "DejaVu Sans", Arial; display:block; background: #c0cf88; border-bottom: solid 3px #573; padding: 5px; margin-top: 0px; color: #573;'><a href="https://kallithea-scm.org/repos/kallithea/changeset/1e80013ac8af03afdbfae084f7b2644f13407a45" style="text-decoration: none; font-weight: bold; color: #573;">style: don't apply this text field styling to buttons These recently introduced style rules were a bit too broad.</a></h1>
<div id="body">
kwi committed on 2017-01-03 15:58:56<br />branch: default<br />changeset: <a href="https://kallithea-scm.org/repos/kallithea/changeset/1e80013ac8af03afdbfae084f7b2644f13407a45">1e80013a</a><pre>style: don't apply this text field styling to buttons<br /><br />These recently introduced style rules were a bit too broad.
M kallithea/public/css/style.css (4 lines added, 2 lines removed)</pre>
</div>
</div>
</div>
</body>
</html>
<!DOCTYPE html>
<html>
<head>
</head>
<body style='font: 12pt Roboto, "DejaVu Sans", Arial; margin-left: 5px; margin-right: 5px;'>
<div id="entry">
<h1 style='font: 12pt Roboto, "DejaVu Sans", Arial; display:block; background: #c0cf88; border-bottom: solid 3px #573; padding: 5px; margin-top: 0px; color: #573;'><a href="https://kallithea-scm.org/repos/kallithea/changeset/98dd279582803299356502051fe00e161776bf9e" style="text-decoration: none; font-weight: bold; color: #573;">test: bump pytest minimum version Recent test case changes broke compatibility with pytest < 3.0. FYI, the ~= version spec is a shorthand (PEP 440) used he...</a></h1>
<div id="body">
kwi committed on 2017-01-02 19:01:53<br />branch: default<br />changeset: <a href="https://kallithea-scm.org/repos/kallithea/changeset/98dd279582803299356502051fe00e161776bf9e">98dd2795</a><pre>test: bump pytest minimum version<br /><br />Recent test case changes broke compatibility with pytest < 3.0.<br /><br />FYI, the ~= version spec is a shorthand (PEP 440) used here to select<br />"3.0 or any later 3.* release". We could probably use this more often.
M dev_requirements.txt (1 lines added, 1 lines removed)</pre>
</div>
</div>
</div>
</body>
</html>
<!DOCTYPE html>
<html>
<head>
</head>
<body style='font: 12pt Roboto, "DejaVu Sans", Arial; margin-left: 5px; margin-right: 5px;'>
<div id="entry">
<h1 style='font: 12pt Roboto, "DejaVu Sans", Arial; display:block; background: #c0cf88; border-bottom: solid 3px #573; padding: 5px; margin-top: 0px; color: #573;'><a href="https://kallithea-scm.org/repos/kallithea/changeset/c987aa2eb2a808810edf6939c52ca64b25e4b421" style="text-decoration: none; font-weight: bold; color: #573;">compare: remove old Dulwich hack We no longer support Dulwich 0.9.9, so don't need the workaround.</a></h1>
<div id="body">
kwi committed on 2016-11-10 14:09:47<br />branch: default<br />changeset: <a href="https://kallithea-scm.org/repos/kallithea/changeset/c987aa2eb2a808810edf6939c52ca64b25e4b421">c987aa2e</a><pre>compare: remove old Dulwich hack<br /><br />We no longer support Dulwich 0.9.9, so don't need the workaround.
M kallithea/controllers/compare.py (2 lines added, 3 lines removed)</pre>
</div>
</div>
</div>
</body>
</html>
<!DOCTYPE html>
<html>
<head>
</head>
<body style='font: 12pt Roboto, "DejaVu Sans", Arial; margin-left: 5px; margin-right: 5px;'>
<div id="entry">
<h1 style='font: 12pt Roboto, "DejaVu Sans", Arial; display:block; background: #c0cf88; border-bottom: solid 3px #573; padding: 5px; margin-top: 0px; color: #573;'><a href="https://kallithea-scm.org/repos/kallithea/changeset/ee6b7e9f34e691b02d3c5d787776d616d1714ff0" style="text-decoration: none; font-weight: bold; color: #573;">auth: perform basic HTTP security checks already in BaseController There's no reason to postpone these to a LoginRequired decorated controller function. Thi...</a></h1>
<div id="body">
kwi committed on 2016-09-22 22:29:30<br />branch: default<br />changeset: <a href="https://kallithea-scm.org/repos/kallithea/changeset/ee6b7e9f34e691b02d3c5d787776d616d1714ff0">ee6b7e9f</a><pre>auth: perform basic HTTP security checks already in BaseController<br /><br />There's no reason to postpone these to a LoginRequired decorated<br />controller function. This way, they run unconditionally for all<br />subclasses of BaseController (so everything except JSON-RPC and<br />VCS controllers).
M kallithea/lib/auth.py (0 lines added, 27 lines removed)
M kallithea/lib/base.py (35 lines added, 0 lines removed)
A kallithea/tests/functional/test_basecontroller.py (12 lines added, 0 lines removed)</pre>
</div>
</div>
</div>
</body>
</html>
<!DOCTYPE html>
<html>
<head>
</head>
<body style='font: 12pt Roboto, "DejaVu Sans", Arial; margin-left: 5px; margin-right: 5px;'>
<div id="entry">
<h1 style='font: 12pt Roboto, "DejaVu Sans", Arial; display:block; background: #c0cf88; border-bottom: solid 3px #573; padding: 5px; margin-top: 0px; color: #573;'><a href="https://kallithea-scm.org/repos/kallithea/changeset/245b4e3abf399fb6770afb9b4916baab51bff15c" style="text-decoration: none; font-weight: bold; color: #573;">auth: add AuthUser.is_anonymous, along with some exposition This reveals the name of the NotAnonymous decorator to be misleading, an unfortunate detail only...</a></h1>
<div id="body">
kwi committed on 2017-01-02 19:35:25<br />branch: default<br />changeset: <a href="https://kallithea-scm.org/repos/kallithea/changeset/245b4e3abf399fb6770afb9b4916baab51bff15c">245b4e3a</a><pre>auth: add AuthUser.is_anonymous, along with some exposition<br /><br />This reveals the name of the NotAnonymous decorator to be misleading,<br />an unfortunate detail only documented here, but which must be properly<br />resolved in a later changeset.<br /><br />Note that NotAnonymous behaves as advertised as long as it is used<br />together with LoginRequired, which is always the case in the current<br />code, so there's no actual security issue here, the code is just weird,<br />hard to read and fragile.<br /><br />---<br /><br />Some thoughts on cleaning this up in a future changeset: As it turns<br />out, every controller (except the login page!) should be LoginRequired<br />decorated (since it doesn't actually block anonymous users, as long as<br />anonymous access is enabled in the Kallithea config). Thus the most<br />obvious solution would be to move the LoginRequired functionality into<br />BaseController (with an override for LoginController), and delete the<br />decorator entirely. However, LoginRequired does one other thing: it<br />carries information about whether API access is enabled for individual<br />controller methods ("<b>@LoginRequired</b>(api_key=True)"), and also performs<br />the check for this, something which is not easily moved into the base<br />controller class, since the base controller doesn't know which method is<br />about to be called. Possibly that can be determined by poking Pylons,<br />but such code is likely to break with the upcoming TurboGears 2 move.<br />Thus such cleanup is probably better revisited after the switch to TG2.
M kallithea/lib/auth.py (24 lines added, 11 lines removed)</pre>
</div>
</div>
</div>
</body>
</html>
<!DOCTYPE html>
<html>
<head>
</head>
<body style='font: 12pt Roboto, "DejaVu Sans", Arial; margin-left: 5px; margin-right: 5px;'>
<div id="entry">
<h1 style='font: 12pt Roboto, "DejaVu Sans", Arial; display:block; background: #c0cf88; border-bottom: solid 3px #573; padding: 5px; margin-top: 0px; color: #573;'><a href="https://kallithea-scm.org/repos/kallithea/changeset/06398585de039e3767d19bf51c3de5e69b762dd3" style="text-decoration: none; font-weight: bold; color: #573;">auth: track API key used for authentication in AuthUser This allows us to define only once how an API key is passed to the app. We might e.g. allow API keys...</a></h1>
<div id="body">
kwi committed on 2016-11-10 19:38:40<br />branch: default<br />changeset: <a href="https://kallithea-scm.org/repos/kallithea/changeset/06398585de039e3767d19bf51c3de5e69b762dd3">06398585</a><pre>auth: track API key used for authentication in AuthUser<br /><br />This allows us to define only once how an API key is passed to the app.<br />We might e.g. allow API keys to be passed in an HTTP header; with this<br />change, we only need to update the code in one place.<br /><br />Also change the code to verify up front that the API key resolved to a<br />valid and active user, so LoginRequired doesn't need to do that.<br /><br />Also return plain 403 Forbidden for bad API keys instead of redirecting<br />to the login form, which makes more sense for non-interactive clients<br />(the typical users of API keys).
M kallithea/lib/auth.py (10 lines added, 13 lines removed)
M kallithea/lib/base.py (7 lines added, 4 lines removed)
M kallithea/tests/functional/test_login.py (5 lines added, 5 lines removed)</pre>
</div>
</div>
</div>
</body>
</html>
<!DOCTYPE html>
<html>
<head>
</head>
<body style='font: 12pt Roboto, "DejaVu Sans", Arial; margin-left: 5px; margin-right: 5px;'>
<div id="entry">
<h1 style='font: 12pt Roboto, "DejaVu Sans", Arial; display:block; background: #c0cf88; border-bottom: solid 3px #573; padding: 5px; margin-top: 0px; color: #573;'><a href="https://kallithea-scm.org/repos/kallithea/changeset/9cf90371d0f107664ac324eb2ea28063e6172695" style="text-decoration: none; font-weight: bold; color: #573;">auth: add support for "Bearer" auth scheme (API key variant) This allows the API key to be passed in a header instead of the query string, reducing the risk...</a></h1>
<div id="body">
kwi committed on 2017-01-02 17:51:37<br />branch: default<br />changeset: <a href="https://kallithea-scm.org/repos/kallithea/changeset/9cf90371d0f107664ac324eb2ea28063e6172695">9cf90371</a><pre>auth: add support for "Bearer" auth scheme (API key variant)<br /><br />This allows the API key to be passed in a header instead of the query<br />string, reducing the risk of accidental API key leaks:<br /><br /> Authorization: Bearer <api key><br /><br />The Bearer authorization scheme is standardized in RFC 6750, though<br />used here outside the full OAuth 2.0 authorization framework. (Full<br />OAuth can still be added later without breaking existing users.)
M docs/api/api.rst (8 lines added, 2 lines removed)
M kallithea/lib/base.py (19 lines added, 3 lines removed)
M kallithea/lib/utils2.py (7 lines added, 0 lines removed)
M kallithea/tests/functional/test_login.py (12 lines added, 3 lines removed)</pre>
</div>
</div>
</div>
</body>
</html>
<!DOCTYPE html>
<html>
<head>
</head>
<body style='font: 12pt Roboto, "DejaVu Sans", Arial; margin-left: 5px; margin-right: 5px;'>
<div id="entry">
<h1 style='font: 12pt Roboto, "DejaVu Sans", Arial; display:block; background: #c0cf88; border-bottom: solid 3px #573; padding: 5px; margin-top: 0px; color: #573;'><a href="https://kallithea-scm.org/repos/kallithea/changeset/1341be63734a5b90253bdd1589caf1a01e9266d1" style="text-decoration: none; font-weight: bold; color: #573;">cleanup: use standard NotImplementedError for abstract methods From the Python docs on NotImplementedError: In user defined base classes, abstract meth...</a></h1>
<div id="body">
kwi committed on 2017-01-02 20:43:53<br />branch: default<br />tag: tip<br />changeset: <a href="https://kallithea-scm.org/repos/kallithea/changeset/1341be63734a5b90253bdd1589caf1a01e9266d1">1341be63</a><pre>cleanup: use standard NotImplementedError for abstract methods<br /><br />From the Python docs on NotImplementedError:<br /><br /> In user defined base classes, abstract methods should raise this<br /> exception when they require derived classes to override the method.
M kallithea/lib/auth.py (2 lines added, 4 lines removed)</pre>
</div>
</div>
</div>
</body>
</html>