This is a good practice and maybe related to commit 83337e47
Signed-off-by: Veiko Aasa <veiko17@disroot.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
This prevents writing to an arbitrary directory if running actions script
as a root user.
- Included tests for invalid names
Signed-off-by: Veiko Aasa <veiko17@disroot.org>
[sunil@medhas.org Parametrize the test case]
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
On the Gitweb site, links that end with /HEAD (for example menu links after
selecting 'tree' on the front page) are mistakenly redirected
to the git-http-backend cgi script and an empty page is shown to the user.
Modified Apache2 ScriptAliasMatch regex so that git-http-backend services get
redirected only if they immediately follow repository's name path component.
Links on Gitweb site have additional action component before /HEAD and those
will be handled by the gitweb cgi script.
The relevant git-http-backend source:
https://repo.or.cz/git/debian.git/blob/refs/tags/v2.20.1:/http-backend.c#l706
Signed-off-by: Veiko Aasa <veiko17@disroot.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
Perhaps due to recent changes in distutils, the setup script fails during
install with an error that it is unable to copy actions/__pycache__. Don't
attempt to copy this directory.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
Otherwise, if the backup contains public repos and state before backup is all
private repos, then gitweb interface is not available publicly after restore.
Similar case happens when all restore repos are private and state before that
contains a public repos.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
- add eleven functional tests
- gitweb_configure.html template: add id to the repository list element
to distinct it better.
Closes#1668
Signed-off-by: Veiko Aasa <veiko17@disroot.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
This issue is caused by use of tmpdir fixture which forces the tests to run in a
temporary directory and HTML report to also get generated there.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
When tmpdir fixture is used, the tests run in a separate directory instead of
command execution directory. Any tests that take the current directory and
assume that it contains files will fail. Fix this by taking the path relative to
test module instead.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Stop building plinth package.
This will spark removal of package from unstable as it will not be built for any
source package (NBS, "not built from source") by the "cruft-report" tool.
Eventually it will also be removed from testing as there are not dependencies on
it.
See: https://wiki.debian.org/ftpmaster_Removals
Removal from backports may require filing a ticket in RT.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
- after enabling application, do not enable Apache auth configuration
if a public repository exist.
Closes#1669
Signed-off-by: Veiko Aasa <veiko17@disroot.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
Signed-off-by: Matthias Dellweg <2500@gmx.de>
[sunil@medhas.org Implement set domain as superuser action to make it succeed]
[sunil@medhas.org Minor cosmetic changes]
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
Closes: #1659.
When shortcuts have login_required=False and allow_groups set to a list of
groups, the current behavior for logged in users is to match for allowed_groups
even when login_required is False. Thus, for searx, when public mode is enabled
searx shortcut is not shown for logged in users who are not part of searx group.
Fix this by ignoring allowed_groups if login_required is False.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
When using git-http-backend, both URLs ending with and without .git are allowed.
However, access restriction has only be applied for URLs ending with .git. This
means that private git repositories are clone-able by anonymous users by
removing the .git suffix in the URLs.
Fix the issue by extending the access restriction to cover URLs not ending with
.git.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
- Remove cancel button in favor of back button.
- In create/edit form, make the form full width to make it consistent with other
forms. The styling for all the forms can be changed together, if desired.
- Remove dead HTML code outside block context in inherited template.
- Add missing 'list-group' parent for repository list as suggested by bootstrap.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
- Since Wiki Commons and Icons project seems to be referring to each other for
license about the git icon, point to the upstream git as source for copyright.
- Rename the is_running() method so that it won't clash with the semantics of
is_running method in other components.
- Fix incorrect call to have_public_repos() in is_enabled() method for gitweb
auth configuration.
- Use {{ block.super }} to avoid repeating inherited block.
- Send the repository data as context data rather than form data in AppView.
This seems more appropriate.
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
- Add a function to the ssh module that returns information about the SSH host
keys as dict.
- Move SSHAppView to a new ssh/views.py.
- Add the ssh host key information to the SSHAppView context.
- Create a template for the SSH module.
- Display the sshkeys context information in the template below the status area.
Closes: #1650
Signed-off-by: Birger Schacht <birger@rantanplan.org>
[sunil@medhas.org Minor styling updates for variable names, isort, yapf]
[sunil@medhas.org Styling updates on the HTML output for consistency]
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
