November 2009 - YaST Commits - openSUSE Mailing Lists

[yast-commit] Hudson build is back to normal: webyast-service-11.1-i586 #597
by Hudson Integration Service 02 Nov '09

02 Nov '09

See http://yast.suse.de:3334/job/webyast-service-11.1-i586/597/changes -- To unsubscribe, e-mail: yast-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: yast-commit+help(a)opensuse.org

1 0

[yast-commit] <web-client> master : fixed skipping page onClick and added more css
by Robert Lihm 02 Nov '09

02 Nov '09

ref: refs/heads/master commit b717aa6e3342d60f73a90b03b1a28e8f8e4af119 Author: Robert Lihm <rlihm(a)lihmedia.org> Date: Mon Nov 2 17:00:44 2009 +0100 fixed skipping page onClick and added more css --- plugins/network/app/views/network/index.html.erb | 4 +--- webclient/public/javascripts/script.js | 1 + webclient/public/stylesheets/style.css | 12 +++++++++--- 3 files changed, 11 insertions(+), 6 deletions(-) diff --git a/plugins/network/app/views/network/index.html.erb b/plugins/network/app/views/network/index.html.erb index 87e97cb..f5d432d 100644 --- a/plugins/network/app/views/network/index.html.erb +++ b/plugins/network/app/views/network/index.html.erb @@ -145,6 +145,4 @@ disabled = <%= write_disabled %> || value != "static"; disable_static_config(disabled); }) -<% end -%> - - +<% end -%> \ No newline at end of file diff --git a/webclient/public/javascripts/script.js b/webclient/public/javascripts/script.js index f0cbd69..2244068 100644 --- a/webclient/public/javascripts/script.js +++ b/webclient/public/javascripts/script.js @@ -47,6 +47,7 @@ $('.tab-nav a').click(function() { var curTab = $(this).attr('href'); // alert(curTab); $(curTab).show().siblings('fieldset').hide(); + return false; }); diff --git a/webclient/public/stylesheets/style.css b/webclient/public/stylesheets/style.css index 34a10d3..b3c1cd6 100644 --- a/webclient/public/stylesheets/style.css +++ b/webclient/public/stylesheets/style.css @@ -128,7 +128,8 @@ ul li { } #footer { padding: 1em 0; -/* border-top: 1px dotted #ccc;*/ + color: #999; + border-top: 1px dotted #ccc; } /* == Basic Styles ======================================================== */ @@ -329,12 +330,14 @@ ul.list-2level-inline { .tab-form { } -.tab-form fieldset{ +.tab-form fieldset { clear: left; + margin-top: 1em; } ul.tab-nav { list-style: none inside; padding: 0; + overflow: hidden; } .tab-nav li { @@ -354,7 +357,10 @@ ul.tab-nav { -moz-border-radius-topright: 5px; -webkit-border-top-left-radius: 5px; -webkit-border-top-right-radius: 5px; - + } + + .tab-nav li a:hover { + text-decoration: none; } /* == Text Styles ======================================================= */ -- To unsubscribe, e-mail: yast-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: yast-commit+help(a)opensuse.org

1 0

[yast-commit] <web-client> master : robuster client_exception. Showing an exception if it really exists (bnc #550717)
by Stefan Schubert 02 Nov '09

02 Nov '09

ref: refs/heads/master commit 67e44326bc3aaca77d79b74c547fafe115136406 Author: Stefan Schubert <schubi(a)suse.de> Date: Mon Nov 2 16:55:46 2009 +0100 robuster client_exception. Showing an exception if it really exists (bnc #550717) --- webclient/package/yast2-webclient.changes | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) diff --git a/webclient/package/yast2-webclient.changes b/webclient/package/yast2-webclient.changes index 182c13e..a501123 100644 --- a/webclient/package/yast2-webclient.changes +++ b/webclient/package/yast2-webclient.changes @@ -1,4 +1,9 @@ ------------------------------------------------------------------- +Mon Nov 2 16:55:10 CET 2009 - schubi(a)suse.de + +- robuster client_exception. Showing an exception if it really exists (bnc#550717) + +------------------------------------------------------------------- Mon Nov 2 09:00:30 CET 2009 - lslezak(a)suse.cz - removed flag images (icons) (bnc#541528) -- To unsubscribe, e-mail: yast-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: yast-commit+help(a)opensuse.org

1 0

[yast-commit] <web-client> master : robuster client_exception. Showing an exception if it really exists (bnc #550717)
by Stefan Schubert 02 Nov '09

02 Nov '09

ref: refs/heads/master commit cb9de3564b8a54eb0d4bb3a2f07eece139c805ac Author: Stefan Schubert <schubi(a)suse.de> Date: Mon Nov 2 16:54:35 2009 +0100 robuster client_exception. Showing an exception if it really exists (bnc #550717) --- .../app/controllers/patch_updates_controller.rb | 4 ++-- webclient/lib/client_exception.rb | 11 ++++++----- 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/plugins/patch_updates/app/controllers/patch_updates_controller.rb b/plugins/patch_updates/app/controllers/patch_updates_controller.rb index beb3da7..a8614a0 100644 --- a/plugins/patch_updates/app/controllers/patch_updates_controller.rb +++ b/plugins/patch_updates/app/controllers/patch_updates_controller.rb @@ -24,7 +24,7 @@ class PatchUpdatesController < ApplicationController begin patch_updates = load_proxy 'org.opensuse.yast.system.patches', :all rescue Exception => e - error = e + error = ClientException.new(e) patch_updates = nil end @@ -43,7 +43,7 @@ class PatchUpdatesController < ApplicationController end respond_to do |format| - format.html { render :partial => "patch_summary", :locals => { :patch => patches_summary, :error => ClientException.new(error) } } + format.html { render :partial => "patch_summary", :locals => { :patch => patches_summary, :error => error } } format.json { render :json => patches_summary } end end diff --git a/webclient/lib/client_exception.rb b/webclient/lib/client_exception.rb index 405864c..6546940 100644 --- a/webclient/lib/client_exception.rb +++ b/webclient/lib/client_exception.rb @@ -43,31 +43,32 @@ class ClientException < Exception # happened there, or the local one if it is a normal exception def message return @err_msg unless @err_msg.blank? - return @excpt.message + return @excpt.message if @excpt end # remote exception type as a string or "UNDEFINED" def backend_exception_type - return @error_data['type'] if @error_data.has_key?('type') + return @error_data['type'] if (@error_data && @error_data.has_key?('type')) "UNDEFINED" end # if the exception was produced because another exception # happened at the server side def backend_exception? - @excpt.is_a?(ActiveResource::ServerError) and + @excpt and @excpt.is_a?(ActiveResource::ServerError) and @excpt.response.code.to_s =~ /.*503.*|.*500.*/ end # if the exception is discarded to be a bug, like # a service not running on the server side def bug? - return @error_data['bug'] if @error_data.has_key?('bug') + return @error_data['bug'] if (@error_data && @error_data.has_key?('bug')) true end def backtrace - @excpt.backtrace + return @excpt.backtrace if (@excpt && !(a)excpt.backtrace.blank?) + [] end # forward any other method -- To unsubscribe, e-mail: yast-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: yast-commit+help(a)opensuse.org

1 0

[yast-commit] <rest-service> master : log each login which failed
by Josef Reidinger 02 Nov '09

02 Nov '09

ref: refs/heads/master commit f5d99fc2558d284b10f286dd93b943743157b76c Author: Josef Reidinger <jreidinger(a)suse.cz> Date: Mon Nov 2 16:53:09 2009 +0100 log each login which failed --- webservice/app/controllers/sessions_controller.rb | 1 + webservice/package/yast2-webservice.changes | 5 +++++ 2 files changed, 6 insertions(+), 0 deletions(-) diff --git a/webservice/app/controllers/sessions_controller.rb b/webservice/app/controllers/sessions_controller.rb index d88f3e0..9b16cd9 100644 --- a/webservice/app/controllers/sessions_controller.rb +++ b/webservice/app/controllers/sessions_controller.rb @@ -46,6 +46,7 @@ class SessionsController < ApplicationController @cmd_ret["login"] = "granted" @cmd_ret["auth_token"] = { :value => self.current_account.remember_token , :expires => self.current_account.remember_token_expires_at } else + logger.warn "Login failed from ip #{request.remote_ip} with user #{params[:login] ||""}" @cmd_ret["login"] = "denied" BruteForceProtection.instance.fail_attempt end diff --git a/webservice/package/yast2-webservice.changes b/webservice/package/yast2-webservice.changes index 386731c..5fa067f 100644 --- a/webservice/package/yast2-webservice.changes +++ b/webservice/package/yast2-webservice.changes @@ -1,4 +1,9 @@ ------------------------------------------------------------------- +Mon Nov 2 16:52:08 CET 2009 - jreidinger(a)suse.cz + +- log all failed login (user and its ip) (bnc#550377) + +------------------------------------------------------------------- Mon Nov 2 16:12:32 CET 2009 - jreidinger(a)suse.cz - add brute force attack protection (bnc#550377) -- To unsubscribe, e-mail: yast-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: yast-commit+help(a)opensuse.org

1 0

[yast-commit] <web-client> master : added space between flash-message and next content (Bug #547179)
by Robert Lihm 02 Nov '09

02 Nov '09

ref: refs/heads/master commit f60c0a4fdf8218bff85d12a3f2f5267f7f649de0 Author: Robert Lihm <rlihm(a)lihmedia.org> Date: Mon Nov 2 16:47:02 2009 +0100 added space between flash-message and next content (Bug #547179) --- webclient/public/stylesheets/style.css | 8 +++++++- 1 files changed, 7 insertions(+), 1 deletions(-) diff --git a/webclient/public/stylesheets/style.css b/webclient/public/stylesheets/style.css index 051454b..34a10d3 100644 --- a/webclient/public/stylesheets/style.css +++ b/webclient/public/stylesheets/style.css @@ -542,4 +542,10 @@ th.checkbox { .form-details { font-size: 0.8em; color: #666; -} \ No newline at end of file +} + +/* Error Messages */ + +#flash-messages { + margin-bottom: 1em; +} -- To unsubscribe, e-mail: yast-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: yast-commit+help(a)opensuse.org

1 0

[yast-commit] <web-client> master : fixed position of #footer in DOM.
by Robert Lihm 02 Nov '09

02 Nov '09

ref: refs/heads/master commit 038e7ab745317e6663b9d23076bd7d8e9ac02b25 Author: Robert Lihm <rlihm(a)lihmedia.org> Date: Mon Nov 2 16:43:28 2009 +0100 fixed position of #footer in DOM. --- plugins/network/app/views/network/index.html.erb | 21 --------------------- webclient/app/views/layouts/main.rhtml | 14 ++++++-------- webclient/public/stylesheets/style.css | 4 ++-- 3 files changed, 8 insertions(+), 31 deletions(-) diff --git a/plugins/network/app/views/network/index.html.erb b/plugins/network/app/views/network/index.html.erb index 6460e40..87e97cb 100644 --- a/plugins/network/app/views/network/index.html.erb +++ b/plugins/network/app/views/network/index.html.erb @@ -147,25 +147,4 @@ }) <% end -%> - - diff --git a/webclient/app/views/layouts/main.rhtml b/webclient/app/views/layouts/main.rhtml index 694e968..bd4ac28 100644 --- a/webclient/app/views/layouts/main.rhtml +++ b/webclient/app/views/layouts/main.rhtml @@ -60,15 +60,14 @@ <% end -%> </div> </div> - + <div id="content" class="content"> - - +  <div id="flash-messages"> - <div id="language_selection"/> + <div id="language_selection"></div>  - + <% flash.each do |flash_type, message| %> <% flash_icon = case flash_type @@ -80,14 +79,13 @@ else "ui-state-highlight" end %> - + <div class="flash-message <%= flash_style %> ui-corner-all" style="margin-top: 20px; padding: .7em;"> <p><span class="ui-icon <%= flash_icon %>" style="float: left; margin-right: .3em;"></span><strong><%= message %></strong></p> </div> <% flash.delete flash_type -%> <% end %> </div>  -<br/> <div id="progress" style="display:none;"> <%= image_tag("/images/working.gif") %><%=_("...Wait...")%> </div> @@ -97,7 +95,7 @@ <div id="footer" class=""> <div class="copy">© 2009 Novell, Inc.</div> - </div> + </body> </html> diff --git a/webclient/public/stylesheets/style.css b/webclient/public/stylesheets/style.css index f5db94f..051454b 100644 --- a/webclient/public/stylesheets/style.css +++ b/webclient/public/stylesheets/style.css @@ -127,8 +127,8 @@ ul li { margin-bottom: 1.5em; } #footer { - padding: 1em 0 100px; - border-top: 1px dotted #ccc; + padding: 1em 0; +/* border-top: 1px dotted #ccc;*/ } /* == Basic Styles ======================================================== */ -- To unsubscribe, e-mail: yast-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: yast-commit+help(a)opensuse.org

1 0

[yast-commit] <rest-service> master : add Brute force protection
by Josef Reidinger 02 Nov '09

02 Nov '09

ref: refs/heads/master commit 4f74fe5c2ec8c1927b9ebac0073e5b703fb484df Author: Josef Reidinger <jreidinger(a)suse.cz> Date: Mon Nov 2 16:24:21 2009 +0100 add Brute force protection --- webservice/app/controllers/sessions_controller.rb | 6 ++- webservice/lib/brute_force_protection.rb | 63 ++++++++++++++++++++ webservice/package/yast2-webservice.changes | 5 ++ .../test/unit/brute_force_protection_test.rb | 33 ++++++++++ 4 files changed, 106 insertions(+), 1 deletions(-) diff --git a/webservice/app/controllers/sessions_controller.rb b/webservice/app/controllers/sessions_controller.rb index 86295c2..d88f3e0 100644 --- a/webservice/app/controllers/sessions_controller.rb +++ b/webservice/app/controllers/sessions_controller.rb @@ -34,7 +34,10 @@ class SessionsController < ApplicationController self.current_account = Account.authenticate(params[:login], params[:password]) end @cmd_ret = Hash.new - if logged_in? + if BruteForceProtection.instance.blocked? + @cmd_ret["login"] = "blocked" + @cmd_ret["remain"] = BruteForceProtection.instance.last_fail + BruteForceProtection::BAN_TIMEOUT + elsif logged_in? if params[:remember_me] current_account.remember_me unless current_account.remember_token? cookies[:auth_token] = { :value => self.current_account.remember_token , :expires => self.current_account.remember_token_expires_at } @@ -44,6 +47,7 @@ class SessionsController < ApplicationController @cmd_ret["auth_token"] = { :value => self.current_account.remember_token , :expires => self.current_account.remember_token_expires_at } else @cmd_ret["login"] = "denied" + BruteForceProtection.instance.fail_attempt end end diff --git a/webservice/lib/brute_force_protection.rb b/webservice/lib/brute_force_protection.rb new file mode 100644 index 0000000..b5fc899 --- /dev/null +++ b/webservice/lib/brute_force_protection.rb @@ -0,0 +1,63 @@ +# == Brute force Protection class +# === Overview +# +# Singleton class thant remember fail attempts to log to REST-SERVICE. +# After specified time period is failed attemps cleared. +# +# === Usage +# +# When user tries to login ensure that it is not blocked by BruteForceProtection.instance.blocked? +# When user failed to login call BruteForceProtection.instance.fail_attempt + +class BruteForceProtection + include Singleton + + #Specifies number of failed attempts before block + ATTEMPTS_TO_BLOCK=10 + + #Specifies timeout if user failed to login + TIMEOUT_ON_FAIL=2 + + #Specifies how long is login blocked + BAN_TIMEOUT=10*60 #10 minutes + + attr_reader :last_fail + + #Sets initial values + def initialize + @blocked = false + @last_fail = Time.new + @count_failed = 0 + end + + #Returns if login is blocked + def blocked? + unless @blocked + return false + end + + clean_old_block + + return @blocked + end + + # notification that user fail to login + def fail_attempt + clean_old_block #clean old fail attempts + @last_fail = Time.new + @count_failed += 1 + sleep TIMEOUT_ON_FAIL + @blocked = @count_failed >= ATTEMPTS_TO_BLOCK + end + + private + + #Cleans failed attempts if specified time pass + def clean_old_block + if (Time.new - @last_fail) > BAN_TIMEOUT + @blocked = false + @count_failed=0 + end + end + +end diff --git a/webservice/package/yast2-webservice.changes b/webservice/package/yast2-webservice.changes index 965889d..386731c 100644 --- a/webservice/package/yast2-webservice.changes +++ b/webservice/package/yast2-webservice.changes @@ -1,4 +1,9 @@ ------------------------------------------------------------------- +Mon Nov 2 16:12:32 CET 2009 - jreidinger(a)suse.cz + +- add brute force attack protection (bnc#550377) + +------------------------------------------------------------------- Thu Oct 29 12:37:42 CET 2009 - mvidner(a)suse.cz - Removed avahi (zeroconf) usage. diff --git a/webservice/test/unit/brute_force_protection_test.rb b/webservice/test/unit/brute_force_protection_test.rb new file mode 100644 index 0000000..ec7aa6a --- /dev/null +++ b/webservice/test/unit/brute_force_protection_test.rb @@ -0,0 +1,33 @@ +require File.join(File.dirname(__FILE__),"..", "test_helper") + +class BruteForceProtectionTest < ActiveSupport::TestCase + + def setup + @protection = BruteForceProtection.instance + @protection.send "initialize" + end + + def test_not_blocking_clean + assert !(a)protection.blocked? + end + + def test_blocked + BruteForceProtection.const_set "TIMEOUT_ON_FAIL", 0 #disable sleep + (BruteForceProtection.const_get "ATTEMPTS_TO_BLOCK").times do + @protection.fail_attempt + end + assert @protection.blocked? + end + + def test_unblocked_after_period + BruteForceProtection.const_set "TIMEOUT_ON_FAIL", 0 #disable sleep + BruteForceProtection::ATTEMPTS_TO_BLOCK.times do + @protection.fail_attempt + end + old_time = Time.new - (BruteForceProtection::BAN_TIMEOUT+10) + @protection.instance_variable_set("@last_fail", old_time ) # simulate old time in counter + + assert !(a)protection.blocked? + end + +end -- To unsubscribe, e-mail: yast-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: yast-commit+help(a)opensuse.org

1 0

[yast-commit] <web-client> master : moved module icon into content wrapper
by Robert Lihm 02 Nov '09

02 Nov '09

ref: refs/heads/master commit 1817040c851eb8e9ef7041994aa56a1130988fce Author: Robert Lihm <rlihm(a)lihmedia.org> Date: Mon Nov 2 16:17:56 2009 +0100 moved module icon into content wrapper --- plugins/network/app/views/network/index.html.erb | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/plugins/network/app/views/network/index.html.erb b/plugins/network/app/views/network/index.html.erb index 24d4fab..6460e40 100644 --- a/plugins/network/app/views/network/index.html.erb +++ b/plugins/network/app/views/network/index.html.erb @@ -59,8 +59,8 @@ <% end %> <% end %> -<div class='plugin-icon'><img src='/icons/yast-network.png' alt=''/></div> <div class='plugin-content'> +<div class='plugin-icon'><img src='/icons/yast-network.png' alt=''/></div> <h2><%=_("Network")%></h2> <% form_tag("/network", :method => "get") do %> -- To unsubscribe, e-mail: yast-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: yast-commit+help(a)opensuse.org

1 0

[yast-commit] <rest-service> master : - do not dasherize underscores (bnc#551284)
by Jiri Suchomel 02 Nov '09

02 Nov '09

ref: refs/heads/master commit 62e08a9d0ffdf7fb1a1e1598feefe269c385747a Author: Jiri Suchomel <jsuchome(a)suse.cz> Date: Mon Nov 2 15:26:35 2009 +0100 - do not dasherize underscores (bnc#551284) --- .../app/controllers/mail_settings_controller.rb | 8 ++++++-- .../package/yast2-webservice-mailsettings.changes | 6 ++++++ .../package/yast2-webservice-mailsettings.spec | 2 +- 3 files changed, 13 insertions(+), 3 deletions(-) diff --git a/plugins/mail_settings/app/controllers/mail_settings_controller.rb b/plugins/mail_settings/app/controllers/mail_settings_controller.rb index d009176..f120fb2 100644 --- a/plugins/mail_settings/app/controllers/mail_settings_controller.rb +++ b/plugins/mail_settings/app/controllers/mail_settings_controller.rb @@ -14,7 +14,7 @@ class MailSettingsController < ApplicationController @mail.read respond_to do |format| - format.xml { render :xml => @mail.to_xml(:root => "mail_settings", :indent=>2), :location => "none" } + format.xml { render :xml => @mail.to_xml(:root => "mail_settings", :dasherize => false, :indent=>2), :location => "none" } format.json { render :json => @mail.to_json, :location => "none" } end end @@ -27,7 +27,11 @@ class MailSettingsController < ApplicationController @mail = MailSettings.instance @mail.read - @mail.save(params["mail_settings"]) + if params.has_key? "mail_settings" + @mail.save(params["mail_settings"]) + else + logger.warn "mail_settings hash missing in request" + end show end diff --git a/plugins/mail_settings/package/yast2-webservice-mailsettings.changes b/plugins/mail_settings/package/yast2-webservice-mailsettings.changes index f56640c..46838d3 100644 --- a/plugins/mail_settings/package/yast2-webservice-mailsettings.changes +++ b/plugins/mail_settings/package/yast2-webservice-mailsettings.changes @@ -1,4 +1,10 @@ ------------------------------------------------------------------- +Fri Oct 30 15:15:30 CET 2009 - jsuchome(a)suse.cz + +- do not dasherize underscores (bnc#551284) +- 0.0.7 + +------------------------------------------------------------------- Fri Oct 30 08:04:05 CET 2009 - lslezak(a)suse.cz - fixed restdoc packaging diff --git a/plugins/mail_settings/package/yast2-webservice-mailsettings.spec b/plugins/mail_settings/package/yast2-webservice-mailsettings.spec index 056d75c..060ba55 100644 --- a/plugins/mail_settings/package/yast2-webservice-mailsettings.spec +++ b/plugins/mail_settings/package/yast2-webservice-mailsettings.spec @@ -15,7 +15,7 @@ Provides: yast2-webservice:/srv/www/yastws/app/controllers/mail_settings_c License: GPLv2 Group: Productivity/Networking/Web/Utilities Autoreqprov: on -Version: 0.0.6 +Version: 0.0.7 Release: 0 Summary: YaST2 - Webservice - Mail Settings Source: www.tar.bz2 -- To unsubscribe, e-mail: yast-commit+unsubscribe(a)opensuse.org For additional commands, e-mail: yast-commit+help(a)opensuse.org

1 0