November 2011 - Open Build Service Commits

[obs-commits] [PATCH] [webui] Correctly compute and display inherited group roles.
by OBS build-service 03 Nov '11

03 Nov '11

From: Sascha Peilicke <saschpe(a)suse.de> --- src/webui/app/controllers/package_controller.rb | 2 +- src/webui/app/models/package.rb | 2 +- .../app/views/shared/_involved_users.html.erb | 5 ++++- 3 files changed, 6 insertions(+), 3 deletions(-) diff --git a/src/webui/app/controllers/package_controller.rb b/src/webui/app/controllers/package_controller.rb index f85a0e2..3b817d7 100644 --- a/src/webui/app/controllers/package_controller.rb +++ b/src/webui/app/controllers/package_controller.rb @@ -108,7 +108,7 @@ class PackageController < ApplicationController def users @users = [@project.users, @package.users].flatten.uniq - @groups = @project.groups + @groups = [@project.groups, @package.groups].flatten.uniq @roles = Role.local_roles end diff --git a/src/webui/app/models/package.rb b/src/webui/app/models/package.rb index 572091f..9fca326 100644 --- a/src/webui/app/models/package.rb +++ b/src/webui/app/models/package.rb @@ -177,7 +177,7 @@ class Package < ActiveXML::Base groups = [] each_group do |g| if not role or (role and g.role == role) - groups << g.groupd + groups << g.groupid end end return groups.sort.uniq diff --git a/src/webui/app/views/shared/_involved_users.html.erb b/src/webui/app/views/shared/_involved_users.html.erb index 712e6dd..ef6c8b0 100644 --- a/src/webui/app/views/shared/_involved_users.html.erb +++ b/src/webui/app/views/shared/_involved_users.html.erb @@ -133,7 +133,10 @@ <% @roles.each do |role| %> <td> <% if defined? @package %> - <%= check_box_tag("group_" + role + "_" + group, '', @package.group_has_role?(group, role) || @project.group_has_role?(group, role), :disabled => true, :class => :trigger) %> + <%= check_box_tag("group_" + role + "_" + group, '', @package.group_has_role?(group, role), :disabled => true, :class => :trigger) %> + <% if @project.group_has_role?(group, role) %> + <%= link_to(image_tag('project.png', :alt => "Inherited from project", :title => "Inherited from project"), :controller => "project", :action => "users", :project => @project) %> + <% end %> <% else %> <%= check_box_tag("group_" + role + "_" + group, '', @project.group_has_role?(group, role), :disabled => true, :class => :trigger) %> <% end %> -- 1.7.7 -- To unsubscribe, e-mail: obs-commits+unsubscribe(a)opensuse.org To contact the owner, e-mail: obs-commits+owner(a)opensuse.org

1 0

[obs-commits] [PATCH] [webui] Use Ajax POST request again.
by OBS build-service 03 Nov '11

03 Nov '11

From: Sascha Peilicke <saschpe(a)suse.de> Silently closing potential CSRF vulnerabilities... --- src/webui/app/controllers/package_controller.rb | 3 +++ src/webui/app/controllers/project_controller.rb | 4 ++++ src/webui/app/controllers/request_controller.rb | 1 + src/webui/app/views/request/show.html.erb | 15 +++++++++------ .../app/views/shared/_involved_users.html.erb | 13 ++++++++----- 5 files changed, 25 insertions(+), 11 deletions(-) diff --git a/src/webui/app/controllers/package_controller.rb b/src/webui/app/controllers/package_controller.rb index 034567e..f85a0e2 100644 --- a/src/webui/app/controllers/package_controller.rb +++ b/src/webui/app/controllers/package_controller.rb @@ -700,6 +700,7 @@ class PackageController < ApplicationController end def save_person + valid_http_methods :post if not valid_role_name? params[:userid] flash[:error] = "Invalid username: #{params[:userid]}" redirect_to :action => :add_person, :project => @project, :package => @package, :role => params[:role] @@ -721,6 +722,7 @@ class PackageController < ApplicationController end def save_group + valid_http_methods :post #FIXME: API Group controller routes don't support this currently. #group = find_cached(Group, params[:groupid]) group = Group.list(params[:groupid]) @@ -751,6 +753,7 @@ class PackageController < ApplicationController end def remove_group + valid_http_methods :post if params[:groupid].blank? flash[:note] = "Group removal aborted, no group id given!" redirect_to :action => :show, :project => params[:project] and return diff --git a/src/webui/app/controllers/project_controller.rb b/src/webui/app/controllers/project_controller.rb index 9d97ae7..9611d10 100644 --- a/src/webui/app/controllers/project_controller.rb +++ b/src/webui/app/controllers/project_controller.rb @@ -718,6 +718,7 @@ class ProjectController < ApplicationController end def save_person + valid_http_methods :post user = find_cached(Person, params[:userid]) # FIXME/PITA: For invalid input, the lovely API person controller does a 'LIKE' SQL search to still return data. # This leads to a valid Person model instance with no 'login' set. Instead, it contains a list of _all_ users. @@ -736,6 +737,7 @@ class ProjectController < ApplicationController end def save_group + valid_http_methods :post #FIXME: API Group controller routes don't support this currently. #group = find_cached(Group, params[:groupid]) group = Group.list(params[:groupid]) @@ -755,6 +757,7 @@ class ProjectController < ApplicationController end def remove_person + valid_http_methods :post if params[:userid].blank? flash[:note] = "User removal aborted, no user id given!" redirect_to :action => :show, :project => params[:project] and return @@ -769,6 +772,7 @@ class ProjectController < ApplicationController end def remove_group + valid_http_methods :post if params[:groupid].blank? flash[:note] = "Group removal aborted, no group id given!" redirect_to :action => :show, :project => params[:project] and return diff --git a/src/webui/app/controllers/request_controller.rb b/src/webui/app/controllers/request_controller.rb index 13ce5b6..30c9222 100644 --- a/src/webui/app/controllers/request_controller.rb +++ b/src/webui/app/controllers/request_controller.rb @@ -27,6 +27,7 @@ class RequestController < ApplicationController end def modify_review + valid_http_methods :post begin BsRequest.modifyReview(params[:id], params[:new_state], params) render :text => params[:new_state] diff --git a/src/webui/app/views/request/show.html.erb b/src/webui/app/views/request/show.html.erb index 9d4072d..95536b2 100644 --- a/src/webui/app/views/request/show.html.erb +++ b/src/webui/app/views/request/show.html.erb @@ -119,17 +119,20 @@ <% content_for :head_javascript do %> function modifyReview(id, new_state) { var comment = $('#review_comment_' + id).attr('value'); - var path = "/request/modify_review/<%= @id %>?new_state=" + encodeURIComponent(new_state) + "&comment=" + encodeURIComponent(comment); + var data = {new_state: new_state, comment: comment}; if ($('#review_type_' + id).text() == "package") { project_and_package = $('#review_name_' + id).text().split(' / '); - path += "&project=" + encodeURIComponent(project_and_package[0].trim()); - path += "&package=" + encodeURIComponent(project_and_package[1].trim()); + data['project'] = project_and_package[0].trim(); + data['package'] = project_and_package[1].trim(); } else if ($('#review_type_' + id).text() == "user") { - path += "&" + $('#review_type_' + id).text() + "=" + encodeURIComponent($('#review_name_' + id + '_raw').text()); + data[$('#review_type_' + id).text()] = $('#review_name_' + id + '_raw').text(); } else { - path += "&" + $('#review_type_' + id).text() + "=" + encodeURIComponent($('#review_name_' + id).text()); + data[$('#review_type_' + id).text()] = $('#review_name_' + id).text(); } - $.ajax({url: path, + $.ajax({ + url: '<%= url_for(:controller => 'request', :action => 'modify_review', :id => @id) %>', + type: 'POST', + data: data, success: function(data) { $('#review_table td#review_state_' + id).text(data); $('#review_table td#review_buttons_' + id).remove(); diff --git a/src/webui/app/views/shared/_involved_users.html.erb b/src/webui/app/views/shared/_involved_users.html.erb index 9074ad8..712e6dd 100644 --- a/src/webui/app/views/shared/_involved_users.html.erb +++ b/src/webui/app/views/shared/_involved_users.html.erb @@ -11,17 +11,19 @@ type = str.slice(0, str.indexOf('_')); str = str.slice(str.indexOf('_') + 1); role = str.slice(0, str.indexOf('_')); str = str.slice(str.indexOf('_') + 1); + data = {project: '<%= @project %>', package: '<%= @package %>', role: role}; + data[type + 'id'] = str; if (type == 'user') { if ($(this).attr('checked')) { - url = '<%= url_for(:action => "save_person", :project => @project, :package => @package) %>'; + url = '<%= url_for(:action => "save_person") %>'; } else { - url = '<%= url_for(:action => "remove_person", :project => @project, :package => @package) %>'; + url = '<%= url_for(:action => "remove_person") %>'; } } else if (type == 'group') { if ($(this).attr('checked')) { - url = '<%= url_for(:action => "save_group", :project => @project, :package => @package) %>'; + url = '<%= url_for(:action => "save_group") %>'; } else { - url = '<%= url_for(:action => "remove_group", :project => @project, :package => @package) %>'; + url = '<%= url_for(:action => "remove_group") %>'; } } @@ -29,9 +31,10 @@ $('#' + type + '_table input').animate({opacity: 0.2}, 500); $('#' + type + '_table input').disable(); - url += ';' + type + 'id=' + str + ';role=' + role; $.ajax({ url: url, + type: 'POST', + data: data, complete: function() { $('#' + type + '_spinner').hide(); $('#' + type + '_table input').animate({opacity: 1}, 200); -- 1.7.7 -- To unsubscribe, e-mail: obs-commits+unsubscribe(a)opensuse.org To contact the owner, e-mail: obs-commits+owner(a)opensuse.org

1 0

[obs-commits] [PATCH] [webui] Fix CSRF protection with Ajax POST/GET/... requests thru jQuery.
by OBS build-service 03 Nov '11

03 Nov '11

From: Sascha Peilicke <saschpe(a)suse.de> Whenever 'protect_from_forgery' is set in the ApplicationController and a non-GET request happens, Rails-2.x.x checks the 'authenticity_token' request parameter for the CSRF protection token. For Rails-generated forms (like <%= form_tag %>), the authenticity_token is an automatically added hidden input field. For Ajax requests it's similar: Rails-2.x.x uses Prototype as it's default JavaScript toolkit and adds some convenience wrapper to automagically send the 'authenticity_token' (similar for jrails). However, we are using the marvelous jQuery, thus we have to do this ourselves. We could either add the authenticity token in every jQuery Ajax request like this: $.ajax({ url: '<%= url_for ..., %>,' data: { authenticity_token: '<%= form_authenticity_token %>', ... }, success: function() { ... } }); Instead, this commit implements the solution posted here: http://henrik.nyh.se/2008/05/rails-authenticity-token-with-jquery --- .../vendor/bento/layouts/application.html.erb | 4 ++++ src/webui/public/javascripts/application.js | 8 ++++++++ src/webui/public/javascripts/layout-squashed.js | 10 +++++++++- 3 files changed, 21 insertions(+), 1 deletions(-) diff --git a/src/webui/app/views/vendor/bento/layouts/application.html.erb b/src/webui/app/views/vendor/bento/layouts/application.html.erb index f2f982d..65176f3 100644 --- a/src/webui/app/views/vendor/bento/layouts/application.html.erb +++ b/src/webui/app/views/vendor/bento/layouts/application.html.erb @@ -45,6 +45,10 @@ <% end %> <%= yield :ready_function %> }); + <%# See: http://henrik.nyh.se/2008/05/rails-authenticity-token-with-jquery and %> + <% if protect_against_forgery? %> + var CSRF_PROTECT_AUTH_TOKEN = <%= raw form_authenticity_token.inspect %>; + <% end %> <% end %> </head> diff --git a/src/webui/public/javascripts/application.js b/src/webui/public/javascripts/application.js index 320c90b..b49fc7d 100644 --- a/src/webui/public/javascripts/application.js +++ b/src/webui/public/javascripts/application.js @@ -237,3 +237,11 @@ function resizeMonitorBoxes() }); } + +$(document).ajaxSend(function(event, request, settings) { + if (typeof(CSRF_PROTECT_AUTH_TOKEN) == "undefined") return; + // settings.data is a serialized string like "foo=bar&baz=boink" (or null) + settings.data = settings.data || ""; + settings.data += (settings.data ? "&" : "") + "authenticity_token=" + encodeURIComponent(CSRF_PROTECT_AUTH_TOKEN); +}); + diff --git a/src/webui/public/javascripts/layout-squashed.js b/src/webui/public/javascripts/layout-squashed.js index dae5a59..82c446c 100644 --- a/src/webui/public/javascripts/layout-squashed.js +++ b/src/webui/public/javascripts/layout-squashed.js @@ -451,7 +451,7 @@ function setup_buildresult_tooltip(element_id, url) { return "<div id='" + element_id + "_tooltip' style='width: 500px;'>loading buildresult...</div>"; } }); - $('#' + element_id ).mouseover(function() { + $('#' + element_id).mouseover(function() { if ($('#' + element_id + '_tooltip').html() == 'loading buildresult...') { $('#' + element_id + '_tooltip').load(url); } @@ -628,3 +628,11 @@ function resizeMonitorBoxes() }); } + +$(document).ajaxSend(function(event, request, settings) { + if (typeof(CSRF_PROTECT_AUTH_TOKEN) == "undefined") return; + // settings.data is a serialized string like "foo=bar&baz=boink" (or null) + settings.data = settings.data || ""; + settings.data += (settings.data ? "&" : "") + "authenticity_token=" + encodeURIComponent(CSRF_PROTECT_AUTH_TOKEN); +}); + -- 1.7.7 -- To unsubscribe, e-mail: obs-commits+unsubscribe(a)opensuse.org To contact the owner, e-mail: obs-commits+owner(a)opensuse.org

1 0

[obs-commits] [PATCH] [webui] Fix error message for unknown reviewers.
by OBS build-service 03 Nov '11

03 Nov '11

From: Sascha Peilicke <saschpe(a)suse.de> --- src/webui/app/controllers/request_controller.rb | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/webui/app/controllers/request_controller.rb b/src/webui/app/controllers/request_controller.rb index 2f5bef6..13ce5b6 100644 --- a/src/webui/app/controllers/request_controller.rb +++ b/src/webui/app/controllers/request_controller.rb @@ -21,7 +21,7 @@ class RequestController < ApplicationController BsRequest.addReview(params[:id], opts) rescue BsRequest::ModifyError => e - flash[:error] = "Unable add reviewever '#{message}'" + flash[:error] = "Unable add reviewever '#{params[:id]}'" end redirect_to :controller => :request, :action => "show", :id => params[:id] end -- 1.7.7 -- To unsubscribe, e-mail: obs-commits+unsubscribe(a)opensuse.org To contact the owner, e-mail: obs-commits+owner(a)opensuse.org

1 0

[obs-commits] [PATCH] [backend] bs_repserver: add updateinfo.xml query support
by OBS build-service 03 Nov '11

03 Nov '11

From: Michael Schroeder <mls(a)suse.de> --- src/backend/bs_repserver | 27 ++++++++++++++++++++++++++- 1 files changed, 26 insertions(+), 1 deletions(-) diff --git a/src/backend/bs_repserver b/src/backend/bs_repserver index 9c14279..b7d499b 100755 --- a/src/backend/bs_repserver +++ b/src/backend/bs_repserver @@ -752,7 +752,32 @@ sub getbinary_info { my ($cgi, $projid, $repoid, $arch, $path) = @_; my @s = stat($path); die("404 $path: $!\n") unless @s; - my $res = Build::query($path, 'evra' => 1, 'description' => 1); + my $res = Build::query($path, 'evra' => 1, 'description' => 1) || {}; + if (!%$res && $path =~ /\/updateinfo\.xml$/) { + my $updateinfos = readxml($path, $BSXML::updateinfo, 1); + if ($updateinfos && @{$updateinfos->{'update'} || []} == 1) { + my $updateinfo = $updateinfos->{'update'}->[0]; + $res->{'name'} = $updateinfo->{'id'}; + $res->{'version'} = $updateinfo->{'version'}; + $res->{'summary'} = $updateinfo->{'title'}; + $res->{'description'} = $updateinfo->{'description'}; + my $collection = ($updateinfo->{'pkglist'} || {})->{'collection'} || []; + if (@$collection) { + # only look at first collection + for my $package (@{$collection->[0]->{'package'} || []}) { + my $nevr = $package->{'name'}; + $nevr .= ".$package->{'arch'}" if $package->{'arch'}; + if ($package->{'version'}) { + $nevr .= " = "; + $nevr .= "$package->{'epoch'}:" if $package->{'epoch'}; + $nevr .= "$package->{'version'}" if $package->{'version'}; + $nevr .= "-$package->{'release'}" if defined $package->{'release'}; + } + push @{$res->{'provides'}}, $nevr; + } + } + } + } delete $res->{'source'}; delete $res->{'hdrmd5'}; $res->{'mtime'} = $s[9]; -- 1.7.7 -- To unsubscribe, e-mail: obs-commits+unsubscribe(a)opensuse.org To contact the owner, e-mail: obs-commits+owner(a)opensuse.org

1 0

[obs-commits] [PATCH] [backend] improve heuristic that sets the 'relase' element in the updateinfo
by OBS build-service 03 Nov '11

03 Nov '11

From: Michael Schroeder <mls(a)suse.de> --- src/backend/bs_sched | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/src/backend/bs_sched b/src/backend/bs_sched index cb4cace..57168b4 100755 --- a/src/backend/bs_sched +++ b/src/backend/bs_sched @@ -3555,8 +3555,9 @@ sub rebuildpatchinfo { $update->{'id'} = $patchinfo->{'incident'} || $patchinfo->{'name'}; $update->{'title'} = $patchinfo->{'summary'}; $update->{'description'} = $patchinfo->{'description'}; - # XXX + # FIXME: do not guess the release element! $update->{'release'} = $repoid eq 'standard' ? $projid : $repoid; + $update->{'release'} =~ s/_standard$//; $update->{'release'} =~ s/[_:]+/ /g; $update->{'issued'} = { 'date' => $now }; my @references; -- 1.7.7 -- To unsubscribe, e-mail: obs-commits+unsubscribe(a)opensuse.org To contact the owner, e-mail: obs-commits+owner(a)opensuse.org

1 0

[obs-commits] [openSUSE/software-o-o] 3033bb: link RC2
by Stephan Kulow 03 Nov '11

03 Nov '11

Branch: refs/heads/master Home: https://github.com/openSUSE/software-o-o Commit: 3033bb78008ba80b1981d3f7179b546cd72f4ad8 https://github.com/openSUSE/software-o-o/commit/3033bb78008ba80b1981d3f7179… Author: Stephan Kulow <coolo(a)suse.de> Date: 2011-11-03 (Thu, 03 Nov 2011) Changed paths: M app/controllers/main_controller.rb Log Message: ----------- link RC2 -- To unsubscribe, e-mail: obs-commits+unsubscribe(a)opensuse.org To contact the owner, e-mail: obs-commits+owner(a)opensuse.org

1 0

[obs-commits] [openSUSE/software-o-o] 22e776: updated translations
by Stephan Kulow 03 Nov '11

03 Nov '11

Branch: refs/heads/master Home: https://github.com/openSUSE/software-o-o Commit: 22e7764e65fe2cf527e7ba0d692c890fea3dc07e https://github.com/openSUSE/software-o-o/commit/22e7764e65fe2cf527e7ba0d692… Author: Stephan Kulow <coolo(a)suse.de> Date: 2011-11-03 (Thu, 03 Nov 2011) Changed paths: A locale/el/LC_MESSAGES/software.mo M locale/es/LC_MESSAGES/software.mo M locale/fr/LC_MESSAGES/software.mo M locale/gl/LC_MESSAGES/software.mo M locale/hu/LC_MESSAGES/software.mo M locale/km/LC_MESSAGES/software.mo M locale/nb/LC_MESSAGES/software.mo M locale/pl/LC_MESSAGES/software.mo M locale/ru/LC_MESSAGES/software.mo Log Message: ----------- updated translations -- To unsubscribe, e-mail: obs-commits+unsubscribe(a)opensuse.org To contact the owner, e-mail: obs-commits+owner(a)opensuse.org

1 0

[obs-commits] [openSUSE/osc] 17a524: Revert "implemented --output-dir command line opti...
by Marcus Huewe 02 Nov '11

02 Nov '11

Branch: refs/heads/master Home: https://github.com/openSUSE/osc Commit: 17a5242110a4e99fdfb1bf406c708289e8576e60 https://github.com/openSUSE/osc/commit/17a5242110a4e99fdfb1bf406c708289e857… Author: Marcus Huewe <suse-tux(a)gmx.de> Date: 2011-11-02 (Wed, 02 Nov 2011) Changed paths: M osc/commandline.py M osc/core.py Log Message: ----------- Revert "implemented --output-dir command line option" This reverts commit b190f27d007c253610ecfdc10ff333b43f5f38e0. Do not use "pathname" for this. Its sole purpose is to print out the "correct" pathname to the user. The code broke the Project's class update mechanism Commit: 09739317932f6f9de541b0f7e2857c186da62711 https://github.com/openSUSE/osc/commit/09739317932f6f9de541b0f7e2857c186da6… Author: Marcus Huewe <suse-tux(a)gmx.de> Date: 2011-11-02 (Wed, 02 Nov 2011) Changed paths: M osc/commandline.py M osc/core.py Log Message: ----------- - rewrote b190f27d007c253610ecfdc10ff333b43f5f38e0 (support "osc co --output-dir..." option) The initial version was written by Ed Bartosh <eduard.bartosh(a)intel.com> Compare: https://github.com/openSUSE/osc/compare/eac124f...0973931 -- To unsubscribe, e-mail: obs-commits+unsubscribe(a)opensuse.org To contact the owner, e-mail: obs-commits+owner(a)opensuse.org

1 0

[obs-commits] [openSUSE/software-o-o] 365a28: Mention launch parties on promodvd page.
by Andreas Jaeger 02 Nov '11

02 Nov '11

Branch: refs/heads/master Home: https://github.com/openSUSE/software-o-o Commit: 365a280945284103bcc550274cb2fe8649eb71de https://github.com/openSUSE/software-o-o/commit/365a280945284103bcc550274cb… Author: Andreas Jaeger <aj(a)suse.de> Date: 2011-11-02 (Wed, 02 Nov 2011) Changed paths: M app/views/order/new.rhtml Log Message: ----------- Mention launch parties on promodvd page. -- To unsubscribe, e-mail: obs-commits+unsubscribe(a)opensuse.org To contact the owner, e-mail: obs-commits+owner(a)opensuse.org

1 0

[obs-commits] [openSUSE/osc] eac124: - support source cleanup on maintenance incidient ...
by adrian＠suse.de 02 Nov '11

02 Nov '11

Branch: refs/heads/master Home: https://github.com/openSUSE/osc Commit: eac124f9f64a7bf853af7302acaa4d19f8400e28 https://github.com/openSUSE/osc/commit/eac124f9f64a7bf853af7302acaa4d19f840… Author: Adrian Schröter <adrian(a)suse.de> Date: 2011-10-31 (Mon, 31 Oct 2011) Changed paths: M osc/commandline.py M osc/core.py Log Message: ----------- - support source cleanup on maintenance incidient requests -- To unsubscribe, e-mail: obs-commits+unsubscribe(a)opensuse.org To contact the owner, e-mail: obs-commits+owner(a)opensuse.org

1 0