3101 Commits

Author SHA1 Message Date
Sunil Mohan Adapa
a11197b285
email: Increase the size of the message to 100MiB
- This includes the envelope size, so the actual size of the message and
attachments is somewhat lower.

Tests:

- Install the app freshly with the patch. Notice that message_size_limit is set
to 102400000 by running 'postconf message_size_limit'.

- Install the app without the patch. Apply patche and notice that the app is
updated. Notice that message_size_limit is set to 102400000 by running 'postconf
message_size_limit'.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-11-06 13:03:53 -05:00
Sunil Mohan Adapa
f4d8d3d046
ejabberd: Update old STUN URIs to remove 'transport' parameter
- If the STUN/TURN configuration is not managed by FreedomBox, the parameters
are left unchanged.

Tests:

- Install app after installing Coturn. Notice that STUN URI doesn't have a
'transport' parameter.

- Install app without the patches after installing Coturn. Notice that STUN URIs
have 'transport' parameter. Then apply patches. Setup is run. 'transport'
parameter is removed and only one STUN URI is present. matrix-synapse server
restarts successfully and don't have show any errors/warnings regarding
STUN/TURN configuration during startup.

- Install app without patches and set custom STUN/TURN URIs. Apply patches.
Setup is run. The URIs are not changed.

Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-11-05 06:44:07 -05:00
Sunil Mohan Adapa
e42740b589
matrixsynapse: Update old STUN URIs to remove 'transport' parameter
- If the STUN/TURN configuration is not managed by FreedomBox, the parameters
are left unchanged.

Tests:

- Install app after installing Coturn. Notice that STUN URI doesn't have a
'transport' parameter.

- Install app without the patches after installing Coturn. Notice that STUN URIs
have 'transport' parameter. Then apply patches. Setup is run. 'transport'
parameter is removed and only one STUN URI is present. matrix-synapse server
restarts successfully and don't have show any errors/warnings regarding
STUN/TURN configuration during startup.

- Install app without patches and set custom STUN/TURN URIs. Apply patches.
Setup is run. The URIs are not changed.

Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-11-05 06:43:56 -05:00
Sunil Mohan Adapa
e6e6896d0d
coturn: Fix incorrectly passing transport argument to STUN URIs
Closes: #2362.

Passing ?transport= parameter in STUN URIs is invalid. It always uses UDP.
Chrome and perhaps Firefox has recently started enforcing the correct syntax
leading to failures using the Coturn server URIs we set in Janus. This also
likely effects matrix-syanpse and ejabberd clients.

Links:

1) https://www.rfc-editor.org/rfc/rfc7064#section-3.1
2) https://bugs.chromium.org/p/chromium/issues/detail?id=1385735

Tests:

- Install Coturn. Observe that STUN URIs shown don't contain the 'transport'
parameter.

- Install Janus and launch the meeting room. Notice that the STUN URIs in the
room page don't have 'transport' parameter.

- Install ejabberd and notice that the auto-configured STUN URIs don't have
'transport' parameter.

- Install matrix-synapse and notice that the auto-configured STUN URIs don't
have 'transport' parameter.

- Install ejabberd and matrix-synapse. Ensure that STUN URIs manually. They are
not allowed to 'transport' parameter for the STUN URIs but must have transport
parameter for TURN URIs.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-11-05 06:43:54 -05:00
Sunil Mohan Adapa
300f90f2a2
backups: Don't leave services stopped if backup fails
- We stop services before backup and restart them when backup is completed.
However, if backup fails, we are not restarting the services. With this change,
ensure that stopped services are restarted even if backup process fails.

- Similarly for restore operation.

Tests:

- Backup and restore of an app work.

- Functional tests for matrix-synapse work.

- Run the following two tests without the patch to ensure that the reported bug
is reproducible.

- Make a backup operation fail by raising an exception in the privileged code
that takes backup. Enable matrix-synapse app. Run backup including the
matrix-synapse app. Backup fails and shows an error. The service is
stopped before backup and restarted after backup failure.

- Make a restore operation fail by raising an exception in the privileged code
that does restore. Enable matrix-synapse app. Run backup including the
matrix-synapse app and try to restore it. Restore fails and shows an error. The
service is stopped before restore and restarted after restore failure.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-11-04 10:23:57 -04:00
Sunil Mohan Adapa
f105980476
apache: tests: Update to use DiagnosticCheck class
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-11-01 22:08:50 -04:00
Sunil Mohan Adapa
e3c2546b79
datetime: Fix diagnostic test for checking NTP server sync
Fixes: #2384

- This was missed during the original transition to DiagnosticCheck class for
returning diagnostic results.

Tests:

- In vagrant container, test that the diagnostic test result shows up in
datetime app and it passes.

- Running full diagnostics on the system works.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-11-01 22:08:43 -04:00
James Valleroy
1f90047621
diagnostics: Add shortcut to re-run setup for app
- When running diagnostics for an app, if there are any failures or warnings,
  then show a button to re-run setup.

- When showing all diagnostics results, if there are any failures or warnings
  for an app, then show a button to re-run setup for that app.

Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
[sunil: Use Result class instead of strings for comparison]
[sunil: Use flex box's justify-content-between to improve button styling]
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
2023-10-30 22:10:42 -07:00
Joseph Nuthalapati
28143c091a
kiwix: Do not require login to access the app
Kiwix content packages should be publicly accessible by default. Allow
the frontpage shortcut to be accessed without logging in.

Added a functional test to check that Kiwix library can be accessed
without logging in.

Signed-off-by: Joseph Nuthalapati <njoseph@riseup.net>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
2023-10-22 14:04:18 -07:00
Sunil Mohan Adapa
2bf4271e04
glib: Refactor schedule debugging in a central place
Tests:

- Print the interval time in schedule() method and verify that the times are as
expected in develop mode and production mode.

- Notification shows up for RAM usage if the check hardcoded to True.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-10-21 18:43:20 -04:00
Sunil Mohan Adapa
bdd39850b5
kiwix: Drop unnecessary file in /etc/plinth/modules-enabled
We already have one in /usr/share/freedombox/modules-enabled.

Tests:

- Run ./setup.py install and ensure that app shows up in the UI.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
2023-10-18 16:01:45 -07:00
Sunil Mohan Adapa
cfdf92cf0d
kiwix: Fix various issues after review
- Fix icon paths in copyright file.

- Minor refactoring.

- Add Kiwix library link to app page as well as users may want to see the
  content available before installing the app.

- Consolidate terminology to 'content package' for UI and just 'package'
internally.

- Drop unused SYSTEM_USER constant.

- Simplify the ExecStart= in systemd service file.

- Fix incorrect i18n caused by non-lazy formatting of strings.

- Confirm that xml parsing is not vulnerable as expat library of required
version is used in Debian bookworm.

- Don't start the kiwix daemon when managing library if app is disabled.

- Ignore errors when removing files during uninstallation.

- Handle failures more gracefully when library XML file does not have required
attributes.

- Update SVG/PNG icons to adhere to FreedomBox guidelines.

- Trim block translations in templates.

- Drop comments/deadcode inside translation strings.

- Drop a comment inside add content page that only makes sense with multiple
methods for adding content.

- tests: Don't use pkg_resources library as it is deprecated. We can use
importlib.resources library in future if we run tests on zip installations.

- Fix potential security issues while writing file to tmp directory.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
2023-10-17 13:40:31 -07:00
Joseph Nuthalapati
34976ac4b0
kiwix: Add app for Kiwix offline Wikipedia reader
Signed-off-by: Joseph Nuthalapati <njoseph@riseup.net>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
2023-10-17 13:40:22 -07:00
Sunil Mohan Adapa
36d9f2611f
matrix-synapse: Update warning on how to change domain name
- It does not look like matrix-synapse will ever support changing domain name.

- Our only recourse is to uninstall and install the app. Mention this solution
to users and its consequences upfront.

Tests:

- Test that message got updated during setup after installation.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-10-07 05:54:30 +09:00
Sunil Mohan Adapa
dbd59c0ef5
upgrades: Allow matrix-synapse to be installed from bookworm
- Update the outdated apt preferences file that still refers to
bullseye-backports instead of bookworm-backports.

- Perform matching using n= instead of a= for matching distribution codename.

- Drop preferences for libraries that were only required in bullseye-backports
and not in bookworm-backports.

Tests:

- Install matrix-synapse app in testing container and stable container.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-10-07 05:54:27 +09:00
Sunil Mohan Adapa
a0032856fd
diagnostics: Refactor background diagnostics task
- When running full diagnostics manually, we can use the Operation class. This
allows us to use many of its features.

  - Ensure only one task is running at any time. No need to use running_task
  global variable and a lock for it.

  - Don't run the operation if app install/uninstall or other potentially
  contentious tasks are running.

  - Since Operation object creates a thread, don't create another one with
  glib.schedule(). Don't wait unnecessarily for the operation to finish in the
  glib thread (or glib created thread).

- Since the app will show progress of operations when an operation is running,
it would not be possible to show progress of diagnostics running. So, create a
separate page for diagnostics results.

Tests:

- Run diagnostics and see redirection happens to diagnostics results page.
Results page shows ongoing tests. It refreshes automatically. When tests are
completed, 'Re-run diagnostics' button is shown.

- When visiting /diagnostics/full/ URL is visited without running the test. Only
the re-run button is shown. No results are shown. If tests have been run, re-run
button along with results are shown.

- On the app page, if the tests have been run, a button for viewing results is
shown. Otherwise, the button is not shown.

- In development mode, background diagnostics are run after 3 minutes (change
the time to 150 seconds if database locked errors show up). Results are
available in the results page.

- Make a diagnostic test fail by changing code or disabling a daemon. Run
diagnostics and notice that a notification is shown with the button to go to the
results. Clicking on the button shows the results page. Clicking dismiss removes
the notification.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-10-07 04:52:28 +09:00
Sunil Mohan Adapa
465e452daf
diagnostics: Refactor check IDs, tests and background checks
- Ensure that each diagnostic test category can be identified by easy prefix
matching on the test ID.

- Give a different unique IDs each different kind of test. More specific tests
of a type get a different kind of ID.

- Make comparison of diagnostic test results in test cases more comprehensive.

- Simplify code that shows the number if issues identified.

- In many languages, there is complex logic to write plural forms. Plurals
can't be handled by assuming singular = 1 item and plural is > 1. Translation of
messages in Notification does not support plurals properly. Avoid this for now
by using sometimes incorrect plural form.

- For i18n we should avoid joining phrases/words. Words don't always maintain
order after translation.

- Notify about the total number of issues in diagnostics and not just the most
severe category. This is likely to draw more attention and avoid i18n
complexity.

- Dismiss the diagnostic notification if the latest run succeeded completely.

Tests:

- Unit tests pass.

- Diagnostics for following apps works: networks (drop-in config),
apache (daemon, listen address, internal firewall, external firewall),
tor (netcat), torproxy (internal only firewall, torproxy url, torproxy using
tor), privoxy (privoxy url, package available, package latest),

- Untested: Is release file available method in upgrades app.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-10-07 04:52:22 +09:00
Sunil Mohan Adapa
a233bbfd9b
operation: Add unique ID for each operation
- Helps in retrieving an operation that is currently running.

- Prevent starting an operation that is already running.

Tests:

- Unit tests work.

- Installing, uninstalling an app works.

- For upgrading an app works.

- Running background diagnostics works.

- Updating tor configuration works.

- Updating torproxy configuration works.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-10-07 04:52:17 +09:00
James Valleroy
79f36e6a0c
diagnostics: Add DiagnosticCheck dataclass
- Set unique check_id for each diagnostic check.

- Result is a string-based enumeration. The default value (NOT_DONE) can be
  used for diagnostic checks that have not been completed yet.

- Result is StrEnum so that the return value of check_url can still be used
  directly as a diagnostic result.

Closes: #2375

Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
2023-10-07 04:52:13 +09:00
James Valleroy
d9491d5762
diagnostics: Run daily check and notify on failures
- One notification is shown with a count of the highest severity issues.

- Un-dismiss the notification, so it is shown even if previously dismissed.

- Add link to see the results, which are stored in a global variable.

- Add a lock for running_task.

Tests:

- Notification with 2 warnings shown on stable container due, to packages not
  upgraded.

- Change the firewalld default zone to public. After the next run, the
  notification changes to an error, and shows 1 failure.

Helps #2366.

Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
2023-10-07 04:52:08 +09:00
Benedek Nagy
8bafabe2f9
backup: Fix bug in adding existing unencryped backup location
borg throws and warning "Warning: Attempting to access a previously unknown
unencryped repository!\nDo you want to continue?" and then fails while asking
for a manual confirmation. Avoid this by telling borg not to prompt (and confirm
yes).

This commit provides a fix for the issue described here:

https://discuss.freedombox.org/t/how-do-i-restore-freedombox/2022/10

[sunil: Drop the part about handling the error message]
Signed-off-by: Benedek Nagy <contact@nbenedek.me>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
2023-10-04 10:41:22 -07:00
Sunil Mohan Adapa
9cfd8a2e55
email: Fix issue with install caused by missing drop-in config file
During installation of email app, sievec is run on
/etc/dovecot/freedombox-sieve-after/sort-spam.sieve file to produce a binary
version of the file. However, this file is not available until after the app is
enabled. This is due to the newly introduced drop-in configuration mechanism. To
fix this, during setup, enable the drop-in configuration component responsible
for this file. The component is newly split from the component that deals with
all drop-in components so that not all the drop-in configuration files are
symlinked.

There is no change needed to the app when the drop-in configuration component is
split into multiple components. This is true for all three state of the app;
not-installed, installed-enabled, and installed-disabled.

Tests:

- Install latest code with ./setup.py install. Install the app and it works.

- Uninstall the app and reinstall. It works. There are no warnings that config
file have been replaced with symlinks.

- /etc/dovecot/freedombox-sieve-after has the sort-span.svbin binary sievec
compiled file.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-10-02 14:06:02 +09:00
Sunil Mohan Adapa
38ece87c6c
*: Utilize newer 3.10 syntax for type hints
Tests:

- mypy does not show any errors.

- Installing ejabberd app works. Privileged actions run fine.

- Unit tests work.

- No additional testing was done as type annotations don't have any effect at
runtime.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-09-25 20:03:34 -04:00
Sunil Mohan Adapa
2dd00a8f08
*: Fix all typing hint related errors
- Try to mark class variables in component classes.

- Leave typing hints generic, such as 'list' and 'dict' where content is usually
not filled, too complex, or context is unimportant.

- backups: Handle failure for tarfile extraction so that methods are not called
on potentially None valued variables.

- backups: Prevent potentially passing a keyword argument twice.

- dynamicdns: Deal properly with outcome of urlparsing.

- ejabberd: Deal with failed regex match

- email: Fix a mypy compliant when iterating a filtered list.

- tor: Don't reuse variables for different typed values.

- tor: Don't reuse variables for different typed values.

- operation: Return None explicitly.

- operation: Ensure that keyword argument is not repeated.

Tests:

- Where only typing hints were modified and no syntax error came up, additional
testing was not done.

- `mypy --ignore-missing-imports .` run successfully.

- Generate developer documentation.

- Service runs without errors upon start up.

- backups: Listing and restoring specific apps from a backup works.

- backups: Mounting a remote backup repository works.

- NOT TESTED: dynamicdns: Migrating from old style configuration works.

- ejabberd: Verify that setting coturn configuration works.

- email: Test that showing configuration from postfix works.

- tor: Orport value is properly shown.

- transmission: Configuration values are properly set.

- users: Running unit tests as root works.

- operation: Operation status messages are show properly during app install.

- ./setup.py install runs

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-09-25 20:03:24 -04:00
Sunil Mohan Adapa
ac84258f05
upgrades: Fix detecting apt over tor during upgrade
- This was missed during the split of tor/torproxy apps.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-09-25 20:03:16 -04:00
Sunil Mohan Adapa
995749a975
wordpress: Use absolute path in service file
This is the recommended approach. On Debian, php is usually resolved to
/usr/bin/php.

Tests:

- Tests with absolute path in service file were performed as part of testing
done in https://salsa.debian.org/freedombox-team/freedombox/-/issues/2373 . No
separate testing was done.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-09-25 17:41:11 -04:00
rsquared
a6165c997a
ikiwiki: Disable discussion pages by default for new wiki/blog
Closes: #2102.

- Wiki: Unchanged behavior is to have discussion pages enabled. To post users
must login.

- Blog: Earlier behavior is to allow anonymous users to post comments. They go
into the moderation queue when posted. This could lead to a lot of spam comments
to moderate. New behavior is to allow posting comments only when logged in.

- Blog: discussion => 0 does not effect comments. It is meant for discussion
page on the blog's home page (and possibly other pages). Discussion on those
pages is disabled by default.

- The changes only apply to defaults. Everything can be changed from Setup page.

Testing:

- Test the above described behavior in Debian testing.

- Debian stable testing was not done as the version of ikiwiki is that same as
testing.

[sunil: Drop removal of discussion from wiki pages]
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
2023-09-25 12:58:04 -07:00
Sunil Mohan Adapa
fa58633e81
openpvn: Renew server/client certificates
- Set renewal period to 3 years before expiry so that users not inconvenienced
too much.

- Renew server certificate if possible.

- There are openvpn server setups where the expiry of the server certificate has
been set to 2 years due to a bug in our code. Triggering a setup call will renew
these certificates without effecting any clients. Even during the bug, CA certs
were still be valid for 10 years. So, they are unaffected.

- When downloading profile, if client certificate is renewable, renew
before providing profile for download. Old certificates will still be valid
until their expiry.

Tests:

- Without the patches, install openvpn app. Server certificate will be created
with a validity of 2 years. Download the client profile. Apply patches, setup
will be rerun. OpenVPN will be restarted. Server certificate will be renewed and
show 10 years expiry. Old client profile will continue to connect successfully.
It will have expiry of 2 years. Download the client profile again. It will an
expiry of 10 years and will successfully to the server.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-08-28 16:53:17 -04:00
Sunil Mohan Adapa
251e2b4064
openvpn: Ensure that re-running setup works as expected
- Don't overwrite the entire PKI directory or CA certificates.

- Don't re-enable app during setup.

Tests:

- Install app with patches. Rerun setup. It succeeds. Server certificate is not
changed.

- Disable app. Re-run setup. App is not re-enabled. OpenVPN is not running.

- Enable app. Re-run setup. OpenVPN is restarted.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-08-28 16:53:10 -04:00
Sunil Mohan Adapa
0176d706b9
openvpn: Use config file instead of env vars for easy-rsa
- A configuration file seems to be the preferred approach for invoke easy-rsa
since version 3.

- Drop unused configuration keys KEY_CONFIG, KEY_DIR and EASYRSA_REQ_NAME. These
are no longer referred to in the easy-rsa script.

- Remove configuration key EASYRSA_OPENSSL as the value 'openssl' is already the
default.

- Use pathlib.Path to simplify some code.

Tests:

- Re-run setup and notice the ca.cert file has not changed.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-08-28 16:53:06 -04:00
Sunil Mohan Adapa
95f65b5c4b
openvpn: Minor refactoring in setting up easy-rsa
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-08-28 16:53:04 -04:00
Sunil Mohan Adapa
0e91261446
openvpn: Correctly set expiry of server/client certs to 10 years
- After moving to easy-rsa 3.x, the expiry configuration key changed and
original intention of setting the expiry to 10 years was not working. Update the
key to set the expiry properly.

Tests:

- Install the app freshly and verify the server and client have 'Valid Not
After' date set 10 years in future.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-08-28 16:53:01 -04:00
Sunil Mohan Adapa
ec89d11494
openvpn: Fix app not installing Debian testing
Closes: #2370.

- In Debian testing (trixie), easy-rsa version is 3.1.5 (up from 3.1.0). In this
version trying to sign a certificate request when the final certificate is
already present leads to an error which fails openvpn app installation.

- In versions 3.1.0 (Debian bookworm/stable) and above, build-server-full also
generates a signing request and then signs the request. So, there is no need to
run them separately.

Tests:

- Uninstall openvpn test that /etc/openvpn directory has been removed. Install
openvpn download client profile and connect using 'sudo openvpn --config
tester.ovpn'. The connection will be successful.

- Files /etc/openvpn/freedombox-keys/pki/issues/{server,tester}.ovpn show
signature values.

- Repeat test for Debian testing and stable/bookworm.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-08-28 16:52:57 -04:00
Sunil Mohan Adapa
c4f087ea4a
networks, samba: tests: functional: Fix setting firewall zone
Without the changes, the form submission for setting firewall zone fails with
error similar to "element can't be scrolled to view".

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-08-23 21:47:51 -04:00
Sunil Mohan Adapa
770974c8ce
sso: Switch to django-axes >= 5.0
- Add explicit dependency on django-ipware >=3. django-axes >= 6 adds
only and optional dependency on django-ipware. Adding explicit dependency make
the behavior safer.

- Depend on django-axes >= 5 where the authentication backend and other features
are available. The new code won't work with older versions. The new approach
uses and authentication backend to deny access to the login form on lockout and
a middleware to redirect user to locked out form when limit of attempts have
been reached.

- Drop old code used for compatibility with django-axes 3.x.

- Suppress verbose and debug messages as django-axes is too chatty.

- Re-implment the CAPTCHA form entirely. In the old style, we have a login form
with CAPTCHA field. That would not work with the new django-axes authentication
middle. On submission of the form, auth.authenticate() will be called. This
call invokes various authentication backends include django-axes authentication
backend. This backend's behavior is to reject all authentication attempts when
the IP is listed in locked table. The new approach is to provide a simple
CAPTCHA form with just the CAPTCHA field. If the form is successfully
validated (correct CAPTCHA is provided), then the lock on the IP address is
reset. The user is then free to perform 3 more attempts to login.

- Update firstboot form to send the request parameter when using
auth.authenticate() method. This needed by Django axes' authentication method
which will be triggered.

Tests:

- Run tests on Debian Bookworm and Debian testing.

- Axes verbose messages and debug messages are not printed on the console when
running FreedomBox in debug mode.

- Only three invalid attempts are allowed at the login page. After the final
incorrect attempt, user is redirected to CAPTCHA page. Visiting the login page
using the URL works but entering the correct credentials still takes the user to
CAPTCHA page.

- CAPTCHA form appears as expected. Clicking the CAPTCHA images downloads the
audio file corresponding to the image. Incorrect CAPTCHA shows an error. Correct
CAPTCHA takes the user to login form where they are able to login with correct
credentials. Entering incorrect credentials 3 times will take the user again to
CAPTCHA page.

- Creating user account during firstboot works.

- Blocked IP address the IP of the client such as 10.42.0.1 and not the local IP
address 127.0.0.1 according the django-axes log messages. While one client IP
address is blocked, another IP is able to login to the same user account that
was attempted by the blocked client.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-08-23 21:47:39 -04:00
Sunil Mohan Adapa
cf6c604cec
sso: Use POST method for logout
- This prevents CSRF attacks that allow adversarial websites from logging out
users from FreedomBox. Django itself has made this change in 4.x releases.

Tests:

- Logout works with the menu item in drop-down when Javascript is enabled. The
menu item appears similar to other drop-down menu items.

- Logout works with the menu item when JavaScript is disabled on the page. The
menu item appears similar to other menu items.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-08-23 21:47:36 -04:00
Sunil Mohan Adapa
dc9e86d918
users, networks: Use the autofocus HTML attribute sparingly
Using autofocus too much hurts accessibility[1] as screen readers jump to the
autofocused field. Specifically, it should used only when it increases UX
significantly, when the form is the only thing on the page and there is nothing
to read before the field is filled.

- Networks: There is not much improvement to UX by focusing on a radio select.

- Update User Form: there is a statement to be read before the first element is
filled up. Username is changed rarely but it being focused on.

- First boot user account: There is content to be read before filling the form
and this will be skipped by the screen reader.

Links:

1) https://www.boia.org/blog/accessibility-tips-be-cautious-when-using-autofocus

Tests:

- networks: Add new connection form works. The connection type is not
autofocused.

- users: Update user form works. Username is not autofocused.

- users: First boot form works. Username is not autofocused.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-08-23 21:47:31 -04:00
Sunil Mohan Adapa
ebf2dd5c80
backups: Remove use of length_is template function
- It has been deprecated in Django 4.2

Tests:

- Add a remote backup location with valid SSH hostname and notice that the list
of SSH host keys are shown properly.

- Add a remote backup location with invalid SSH hostname and notice that the
error "Could not reach SSH host..." is shown.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-08-23 21:47:28 -04:00
Sunil Mohan Adapa
dc0b9bed82
zoph: Don't enable app when setup is rerun
Tests:

- Rerun setup after disabling the app. App is not enabled.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-07-31 19:47:13 -04:00
Sunil Mohan Adapa
2c6faf7014
wireguard: Don't enable app when setup is rerun
Tests:

- Rerun setup after disabling the app. App is not enabled.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-07-31 19:47:11 -04:00
Sunil Mohan Adapa
a1217b36be
ttrss: Don't enable app when setup is rerun
Tests:

- Rerun setup after disabling the app. App is not enabled.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-07-31 19:47:09 -04:00
Sunil Mohan Adapa
629c476767
sharing: Don't enable app when setup is rerun
Tests:

- Rerun setup after disabling the app. App is not enabled.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-07-31 19:47:06 -04:00
Sunil Mohan Adapa
a6a7de70e6
shaarli: Don't enable app when setup is rerun
Tests:

- Rerun setup after disabling the app. App is not enabled.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-07-31 19:47:04 -04:00
Sunil Mohan Adapa
9f51fd6a9c
rssbridge: Don't enable app when setup is rerun
Tests:

- Rerun setup after disabling the app. App is not enabled.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-07-31 19:47:01 -04:00
Sunil Mohan Adapa
8d723daec3
radicale: Don't enable app when setup is rerun
Tests:

- Rerun setup after disabling the app. App is not enabled.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-07-31 19:46:59 -04:00
Sunil Mohan Adapa
100592c1d4
quassel: Don't enable app when setup is rerun
Tests:

- Rerun setup after disabling the app. App is not enabled.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-07-31 19:46:52 -04:00
Sunil Mohan Adapa
9fa1e1f563
privoxy: Don't enable app when setup is rerun
Tests:

- Rerun setup after disabling the app. App is not enabled.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-07-31 19:46:50 -04:00
Sunil Mohan Adapa
4444f15c60
performance: Don't enable app when setup is rerun
Tests:

- Rerun setup after disabling the app. App is not enabled.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-07-31 19:46:47 -04:00
Sunil Mohan Adapa
62aa247c8d
openvpn: Don't enable app when setup is rerun
Tests:

- Could not test: rerun setup after disabling the app. App is not enabled.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-07-31 19:46:45 -04:00
Sunil Mohan Adapa
de5d0ce6b0
minetest: Don't enable app when setup is rerun
Tests:

- Rerun setup after disabling the app. App is not enabled.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
2023-07-31 19:46:42 -04:00