File TODO changed (mode: 100644) (index 187ac6d..72ffd6e) |
1 |
1 |
== Where I stopped last time == |
== Where I stopped last time == |
2 |
|
[ ] Add a Terms of Services. Added, but check the link and the create |
|
3 |
|
account form. |
|
4 |
|
[ ] phase1: In mail, ar trebui adaugata si misiunea acestui proiect. |
|
5 |
|
Eventual un FAQ care sa contina si cum vom sustine acest proiect |
|
6 |
|
din punct de vedere financiar. Nu uita de repo-uri privat/publice. |
|
7 |
|
[ ] phase1: add in mail a text like: "...any info ... reply to this e-mail" |
|
8 |
|
[ ] phase1: In mail trebuie sa existe un link catre site-ul principal. |
|
9 |
2 |
[ ] First page: our mission, how do I install it etc.? |
[ ] First page: our mission, how do I install it etc.? |
10 |
|
[ ] phase1: Probably I will define a single plan. |
|
11 |
|
|
|
12 |
|
[ ] Se pare ca sesiunea expira, indifierent daca e activa (apas butoane)! |
|
13 |
|
Unit test? |
|
|
3 |
|
[ ] Seems the session expires even I make some activity. Unit test? |
14 |
4 |
[ ] Check 'description_nice' and apply this everywhere. Maybe we should unset |
[ ] Check 'description_nice' and apply this everywhere. Maybe we should unset |
15 |
5 |
'description', so people will not be tempted to use it. |
'description', so people will not be tempted to use it. |
16 |
6 |
Maybe just overwrite 'description'. |
Maybe just overwrite 'description'. |
|
22 |
12 |
proiectului, e nevoie. Dar intr-un form, in textarea, nu e nevoie. |
proiectului, e nevoie. Dar intr-un form, in textarea, nu e nevoie. |
23 |
13 |
Apoi as putea elimina description_nice. |
Apoi as putea elimina description_nice. |
24 |
14 |
[ ] Security: Link-uri + xss (Ionut) |
[ ] Security: Link-uri + xss (Ionut) |
|
15 |
|
[ ] "UPDATE users SET last_seen" must be done only on logout? |
|
16 |
|
What if the session expires?! |
|
17 |
|
Bun, no way at every page accessed. |
|
18 |
|
Maybe only at login/logout? |
|
19 |
|
[ ] Spell check html files? |
25 |
20 |
[ ] |
[ ] |
26 |
21 |
|
|
27 |
22 |
== BEFORE NEXT RELEASE == |
== BEFORE NEXT RELEASE == |
|
32 |
27 |
[ ] Accessing a file with '"' inside, is not working. |
[ ] Accessing a file with '"' inside, is not working. |
33 |
28 |
See rocketgit.com/user/catalinux/test1/source/tree/blob/"xx\"yy" |
See rocketgit.com/user/catalinux/test1/source/tree/blob/"xx\"yy" |
34 |
29 |
[ ] Build a vm image to offer for download. |
[ ] Build a vm image to offer for download. |
35 |
|
[ ] Add an option to specify a licence for the projects. |
|
|
30 |
|
[ ] Add an option to specify a license for the projects. |
36 |
31 |
[ ] Present bugs as a git repo, so we easily add a new one by push? |
[ ] Present bugs as a git repo, so we easily add a new one by push? |
37 |
32 |
[ ] Configuration: a number of months to keep history (see slaves). |
[ ] Configuration: a number of months to keep history (see slaves). |
38 |
33 |
[ ] vagrant install? |
[ ] vagrant install? |
|
... |
... |
negative de la cache daemon. Vrem asta?! |
82 |
77 |
At least in forgot.php. |
At least in forgot.php. |
83 |
78 |
[ ] Storing password in database must apply multiple hashes. Check owasp. |
[ ] Storing password in database must apply multiple hashes. Check owasp. |
84 |
79 |
They recommend SHA-256(private_key, salt + pass). Think more. |
They recommend SHA-256(private_key, salt + pass). Think more. |
85 |
|
[ ] Regenerate salt on every succesful login? Or after some pre-defined time? |
|
|
80 |
|
[ ] Regenerate salt on every successful login? Or after some pre-defined time? |
86 |
81 |
[ ] Get rid of sessions table and use only hmac! |
[ ] Get rid of sessions table and use only hmac! |
87 |
82 |
We may change the encryption key with an algo. |
We may change the encryption key with an algo. |
88 |
83 |
[ ] Should we skip SELECT/INSERT steps for logout (in token_valid)? |
[ ] Should we skip SELECT/INSERT steps for logout (in token_valid)? |
89 |
84 |
[ ] Persistent connection to database? |
[ ] Persistent connection to database? |
90 |
|
[ ] Check cache socket is protected agains other users. |
|
|
85 |
|
[ ] Check cache socket is protected against other users. |
91 |
86 |
[ ] token: add form id into equation? |
[ ] token: add form id into equation? |
92 |
87 |
[ ] Ce se intimpla daca un atacator seteaza un cookie pe .com, de exemplu. |
[ ] Ce se intimpla daca un atacator seteaza un cookie pe .com, de exemplu. |
93 |
88 |
El se va trimite si pe rocketgit.com. Deci, daca user-ul viziteaza site-ul |
El se va trimite si pe rocketgit.com. Deci, daca user-ul viziteaza site-ul |
|
... |
... |
Daca as lega good.com de a/b, as putea elimina cookie-urile rele. |
100 |
95 |
[ ] "repo_submenu" seems to not be used, remove references. |
[ ] "repo_submenu" seems to not be used, remove references. |
101 |
96 |
[ ] http://nedbatchelder.com/blog/201405/github_monoculture.html |
[ ] http://nedbatchelder.com/blog/201405/github_monoculture.html |
102 |
97 |
[ ] mchapman (subscriber, #66589) (http://lwn.net/Articles/623905/) |
[ ] mchapman (subscriber, #66589) (http://lwn.net/Articles/623905/) |
103 |
|
With a GitHub pull-request-based workflow I need a GitHub account |
|
|
98 |
|
With a GitHub pull-request-based work-flow I need a GitHub account |
104 |
99 |
(I've been resisting getting one for myself), I need to make sure I |
(I've been resisting getting one for myself), I need to make sure I |
105 |
100 |
explicitly "fork" the repository within GitHub (simply pushing my copy |
explicitly "fork" the repository within GitHub (simply pushing my copy |
106 |
101 |
of the repo to my account won't make pull requests work, as far as I |
of the repo to my account won't make pull requests work, as far as I |
|
... |
... |
Daca as lega good.com de a/b, as putea elimina cookie-urile rele. |
108 |
103 |
project are "linked"), and I need to use the GitHub web interface to |
project are "linked"), and I need to use the GitHub web interface to |
109 |
104 |
actually generate the pull request and take part in its review. If all |
actually generate the pull request and take part in its review. If all |
110 |
105 |
of this isn't vendor lock-in, I don't know what is. |
of this isn't vendor lock-in, I don't know what is. |
111 |
|
I've got bigger problems with the GitHub pull request workflow anyway. |
|
|
106 |
|
I've got bigger problems with the GitHub pull request work-flow anyway. |
112 |
107 |
If you generate a pull request, discover that changes need to be made, |
If you generate a pull request, discover that changes need to be made, |
113 |
108 |
you have two choices: you can create a new pull request, losing all |
you have two choices: you can create a new pull request, losing all |
114 |
109 |
comments from the previous one, or you have to add new commits. If |
comments from the previous one, or you have to add new commits. If |
115 |
110 |
you drop the to-be-pulled branch from your repository and replace it |
you drop the to-be-pulled branch from your repository and replace it |
116 |
111 |
with a different branch with the same name, the pull request loses all |
with a different branch with the same name, the pull request loses all |
117 |
112 |
of its comments. |
of its comments. |
118 |
|
No, I find the bigger problems are with pull-request based workflow |
|
119 |
|
that GitHub uses -- specifically, how that workflow interacts with |
|
|
113 |
|
No, I find the bigger problems are with pull-request based work-flow |
|
114 |
|
that GitHub uses -- specifically, how that work-flow interacts with |
120 |
115 |
code review. If your branch is reviewed and it needs modifications, |
code review. If your branch is reviewed and it needs modifications, |
121 |
116 |
then these modifications *should* be made to the original commits |
then these modifications *should* be made to the original commits |
122 |
117 |
(not just tacked on as extra commits), which necessarily means the |
(not just tacked on as extra commits), which necessarily means the |
|
... |
... |
Daca as lega good.com de a/b, as putea elimina cookie-urile rele. |
124 |
119 |
rebase branches. |
rebase branches. |
125 |
120 |
[ ] Should we delete previous session when user calls login if the user is |
[ ] Should we delete previous session when user calls login if the user is |
126 |
121 |
already logged-in? |
already logged-in? |
127 |
|
[ ] Talk in instalation about a php compiler? |
|
|
122 |
|
[ ] Talk in installation about a php compiler? |
128 |
123 |
[ ] cache_set should wait for an answer? Should we send an answer? |
[ ] cache_set should wait for an answer? Should we send an answer? |
129 |
124 |
[ ] security_violation_no_exit -> security_violation? To not spend resources? |
[ ] security_violation_no_exit -> security_violation? To not spend resources? |
130 |
125 |
[ ] We should be able to have multiple logins (think desktop and phone). |
[ ] We should be able to have multiple logins (think desktop and phone). |
131 |
126 |
[ ] Test if cache is faster than postgres. If not, get rid of cache! |
[ ] Test if cache is faster than postgres. If not, get rid of cache! |
132 |
127 |
[ ] Investigate use of persistent prepared sessions. |
[ ] Investigate use of persistent prepared sessions. |
133 |
|
[ ] What happends if we cannot generate a form token?! |
|
|
128 |
|
[ ] What happens if we cannot generate a form token?! |
134 |
129 |
[ ] Add User-Agent to session? |
[ ] Add User-Agent to session? |
135 |
130 |
[ ] Check "Content security policy" |
[ ] Check "Content security policy" |
136 |
131 |
[ ] htmlspcialchars does not escape '/'. It may be dangerous: |
[ ] htmlspcialchars does not escape '/'. It may be dangerous: |
|
... |
... |
But, we have a problem with the expiration time! |
163 |
158 |
[ ] Do we use users.rights?! |
[ ] Do we use users.rights?! |
164 |
159 |
[ ] Add some versioning mechanism to restart the cache daemon when the protocol |
[ ] Add some versioning mechanism to restart the cache daemon when the protocol |
165 |
160 |
changes. |
changes. |
166 |
|
[ ] What happends when a user adds a nonexisting one letter code for rights? |
|
|
161 |
|
[ ] What happens when a user adds a non-existing one letter code for rights? |
167 |
162 |
I should filter it out. |
I should filter it out. |
168 |
163 |
[ ] Log attempts to inject <> inside vars. Maybe in rg_var_str? |
[ ] Log attempts to inject <> inside vars. Maybe in rg_var_str? |
169 |
164 |
[ ] We should not call cosmetic in rights hl because we anyway load again the |
[ ] We should not call cosmetic in rights hl because we anyway load again the |
|
... |
... |
But, we have a problem with the expiration time! |
177 |
172 |
[ ] What right is "Access repo"?! I think is for web. Not clear. Check. |
[ ] What right is "Access repo"?! I think is for web. Not clear. Check. |
178 |
173 |
Seems is used on repo-page.php to give access or not to the repo. |
Seems is used on repo-page.php to give access or not to the repo. |
179 |
174 |
But I should only check if is public. |
But I should only check if is public. |
180 |
|
No, because the same test is used also for pivate repos. |
|
181 |
|
[ ] I have to define what means a 'public' repo: fetch + see bugtracker? |
|
|
175 |
|
No, because the same test is used also for private repos. |
|
176 |
|
[ ] I have to define what means a 'public' repo: fetch + see bug-tracker? |
182 |
177 |
[ ] In loguri, la username, apar unele cu '?'. O fi de la cache |
[ ] In loguri, la username, apar unele cu '?'. O fi de la cache |
183 |
178 |
+ bug-ul in user.inc? |
+ bug-ul in user.inc? |
184 |
179 |
[ ] We should invalidate rights cache when repo goes from public -> private |
[ ] We should invalidate rights cache when repo goes from public -> private |
|
... |
... |
But, we have a problem with the expiration time! |
198 |
193 |
db, but be careful with "HTML:" construct! Audit all HTML: and then |
db, but be careful with "HTML:" construct! Audit all HTML: and then |
199 |
194 |
switch. Do not forget that is a problem how it works now: |
switch. Do not forget that is a problem how it works now: |
200 |
195 |
for example, description that contains '<' will not work correctly. |
for example, description that contains '<' will not work correctly. |
201 |
|
The problem is with HTML: vars that include unescaped vars. |
|
|
196 |
|
The problem is with HTML: vars that include un-escaped vars. |
202 |
197 |
Is it possible? |
Is it possible? |
203 |
198 |
Seems is working for repo description. Do it everywhere? |
Seems is working for repo description. Do it everywhere? |
204 |
199 |
[ ] Add unit test for inject functions. |
[ ] Add unit test for inject functions. |
|
... |
... |
But, we have a problem with the expiration time! |
219 |
214 |
[ ] We should not show delete checkboxes/buttons if a user is not allowed |
[ ] We should not show delete checkboxes/buttons if a user is not allowed |
220 |
215 |
to delete items. |
to delete items. |
221 |
216 |
[ ] In cache, what if a var has \n in it? |
[ ] In cache, what if a var has \n in it? |
222 |
|
[ ] Purge deleted bugs (and notes) in backgrou.nd |
|
|
217 |
|
[ ] Purge deleted bugs (and notes) in background |
223 |
218 |
[ ] Event for bug delete. |
[ ] Event for bug delete. |
224 |
219 |
[ ] CIneva sterge un bug, si apoi altcineva apasa "delete" pe acelasi bug. |
[ ] CIneva sterge un bug, si apoi altcineva apasa "delete" pe acelasi bug. |
225 |
220 |
Va da eroare, dar nu ar trebui sa fie fatala... Eventual sa afisam |
Va da eroare, dar nu ar trebui sa fie fatala... Eventual sa afisam |
|
... |
... |
But, we have a problem with the expiration time! |
227 |
222 |
[ ] No expiration for cache?! |
[ ] No expiration for cache?! |
228 |
223 |
[ ] rg_rights_load and rg_rights_get do the same thing. Remove _load. |
[ ] rg_rights_load and rg_rights_get do the same thing. Remove _load. |
229 |
224 |
[ ] Maybe I should disconnect from cache if a "generation number" does not match |
[ ] Maybe I should disconnect from cache if a "generation number" does not match |
230 |
|
per connection. Think about setting/unsetting a key that fails |
|
|
225 |
|
per connection. Think about setting/un-setting a key that fails |
231 |
226 |
and then issue a get... |
and then issue a get... |
232 |
227 |
[ ] rights_delete_list must invalidate cache. |
[ ] rights_delete_list must invalidate cache. |
233 |
228 |
[ ] Somewhere we must have a section to define the groups and allow rights |
[ ] Somewhere we must have a section to define the groups and allow rights |
|
... |
... |
But, we have a problem with the expiration time! |
237 |
232 |
[ ] I should set 'display_errors' to OFF. |
[ ] I should set 'display_errors' to OFF. |
238 |
233 |
[ ] Maybe add db.users.last_ip_failed? Or the history is enough? |
[ ] Maybe add db.users.last_ip_failed? Or the history is enough? |
239 |
234 |
[ ] db.users.last_ip is used for last IP used for login? |
[ ] db.users.last_ip is used for last IP used for login? |
240 |
|
[ ] repos.disk_quota_mb must be dropped and do a lookup in plan. |
|
|
235 |
|
[ ] repos.disk_quota_mb must be dropped and do a look-up in plan. |
241 |
236 |
[ ] Integrate max_public/private_repos into HL. |
[ ] Integrate max_public/private_repos into HL. |
242 |
237 |
[ ] Allow specifying base language for a project. |
[ ] Allow specifying base language for a project. |
243 |
238 |
[ ] Allow specifying license for a project. |
[ ] Allow specifying license for a project. |
244 |
|
[ ] When changind db structure, invalidate all caches. |
|
|
239 |
|
[ ] When changing db structure, invalidate all caches. |
245 |
240 |
[ ] When we will switch to C, check UTF-8 validation. |
[ ] When we will switch to C, check UTF-8 validation. |
246 |
241 |
[ ] Check http://blog.wikichoon.com/2014/04/github-doesnt-support-pull-request.html |
[ ] Check http://blog.wikichoon.com/2014/04/github-doesnt-support-pull-request.html |
247 |
242 |
[ ] If path for repo_path rights starts with /, it is anchored. |
[ ] If path for repo_path rights starts with /, it is anchored. |
|
... |
... |
But, we have a problem with the expiration time! |
272 |
267 |
[ ] When listing repos, check the rights! |
[ ] When listing repos, check the rights! |
273 |
268 |
For example, a user is allowed to edit a repo, but is not the owner. |
For example, a user is allowed to edit a repo, but is not the owner. |
274 |
269 |
It is not enough to check 'public = 1'. This may generate a lots |
It is not enough to check 'public = 1'. This may generate a lots |
275 |
|
of lookups for rights. :( Not if we cache the whole rights list. |
|
|
270 |
|
of look-ups for rights. :( Not if we cache the whole rights list. |
276 |
271 |
[ ] Add a reason for suspended accounts? Maybe also for other operations? |
[ ] Add a reason for suspended accounts? Maybe also for other operations? |
277 |
272 |
[ ] We should add 'rights.who' to record who gave that right. May be more |
[ ] We should add 'rights.who' to record who gave that right. May be more |
278 |
273 |
admins for the same repo. |
admins for the same repo. |
|
... |
... |
But, we have a problem with the expiration time! |
283 |
278 |
[ ] 'first_install' value is not cached in RAM! |
[ ] 'first_install' value is not cached in RAM! |
284 |
279 |
[ ] Seems that an annotated tag cannot be overwritten, even with rights. |
[ ] Seems that an annotated tag cannot be overwritten, even with rights. |
285 |
280 |
[ ] Test bug.php is not working. Seems that repo_info is not working right for |
[ ] Test bug.php is not working. Seems that repo_info is not working right for |
286 |
|
an inexistent repo_id! |
|
|
281 |
|
an nonexistent repo_id! |
287 |
282 |
[ ] From arora I cannot login! See a tcpdump. |
[ ] From arora I cannot login! See a tcpdump. |
288 |
283 |
[ ] Rights management |
[ ] Rights management |
289 |
284 |
- A user USER is trying to push some commits in a branch B, |
- A user USER is trying to push some commits in a branch B, |
|
... |
... |
But, we have a problem with the expiration time! |
322 |
317 |
Maybe have two files, one with "<right><tab><category>" and one |
Maybe have two files, one with "<right><tab><category>" and one |
323 |
318 |
with "<right><tab><text>". |
with "<right><tab><text>". |
324 |
319 |
I decided to let them in php file, but replace text with a |
I decided to let them in php file, but replace text with a |
325 |
|
translation lookup. |
|
|
320 |
|
translation look-up. |
326 |
321 |
[ ] Remove 'admin' stuff. We will give normal rights. |
[ ] Remove 'admin' stuff. We will give normal rights. |
327 |
322 |
[ ] We will use '*' = all rights, so we can extend the list and some users to |
[ ] We will use '*' = all rights, so we can extend the list and some users to |
328 |
323 |
get them automatically. |
get them automatically. |
|
... |
... |
But, we have a problem with the expiration time! |
337 |
332 |
and/or mark files that have whitespace errors. |
and/or mark files that have whitespace errors. |
338 |
333 |
[ ] Transform user/bug/* into high level functions. |
[ ] Transform user/bug/* into high level functions. |
339 |
334 |
[ ] Maybe, when user is not logged in, on the "Repositories" main menu |
[ ] Maybe, when user is not logged in, on the "Repositories" main menu |
340 |
|
show most active projects, the bigest ones, recent ones and |
|
|
335 |
|
show most active projects, the biggest ones, recent ones and |
341 |
336 |
search form. And remove menu "List" + "Search". |
search form. And remove menu "List" + "Search". |
342 |
337 |
Or, maybe the first page to contain best repos and search form. |
Or, maybe the first page to contain best repos and search form. |
343 |
338 |
[ ] Add possibility to change user time zone. |
[ ] Add possibility to change user time zone. |
344 |
339 |
[ ] At least for notes, add also y/m/d/h/m/s 'ago' next to exact time |
[ ] At least for notes, add also y/m/d/h/m/s 'ago' next to exact time |
345 |
340 |
[ ] We need a matrix testing with: |
[ ] We need a matrix testing with: |
346 |
|
unlogged in user, loggedin user, owner |
|
|
341 |
|
un-logged in user, logged-in user, owner |
347 |
342 |
vs |
vs |
348 |
343 |
public_repo, private_repo, private_repo_with_rights for logged in user |
public_repo, private_repo, private_repo_with_rights for logged in user |
349 |
344 |
We can use a custom theme dir that contains IDs to be able to |
We can use a custom theme dir that contains IDs to be able to |
350 |
|
detect if we give errors. Or just match the english string. |
|
351 |
|
[ ] I may check in the main php if doit == 1 nad token is valid! |
|
|
345 |
|
detect if we give errors. Or just match the English string. |
|
346 |
|
[ ] I may check in the main php if doit == 1 and token is valid! |
352 |
347 |
[ ] I may do a function rg_generic_edit_high_level with an array, as parameter, |
[ ] I may do a function rg_generic_edit_high_level with an array, as parameter, |
353 |
348 |
with functions to call for different stuff. |
with functions to call for different stuff. |
354 |
349 |
[ ] Do not redirect to login page if the user is logged in! |
[ ] Do not redirect to login page if the user is logged in! |
|
... |
... |
But, we have a problem with the expiration time! |
372 |
367 |
repo. It may not be the same person that created it! |
repo. It may not be the same person that created it! |
373 |
368 |
[ ] Add a description field for rights and keys. Maybe other places. |
[ ] Add a description field for rights and keys. Maybe other places. |
374 |
369 |
[ ] Check http://nvie.com/posts/a-successful-git-branching-model/ |
[ ] Check http://nvie.com/posts/a-successful-git-branching-model/ |
375 |
|
[ ] After resetting password, go to the login form, with user prefiled so the user can cache the password. |
|
|
370 |
|
[ ] After resetting password, go to the login form, with user pre-filed so the user can cache the password. |
376 |
371 |
[ ] Add number of bugs multiplied with a value to total disk space. |
[ ] Add number of bugs multiplied with a value to total disk space. |
377 |
372 |
[ ] How should I verify repo rights? |
[ ] How should I verify repo rights? |
378 |
373 |
if (admin) |
if (admin) |
|
... |
... |
But, we have a problem with the expiration time! |
394 |
389 |
Sa incerc sa schitez partea de admin a user-ilor. |
Sa incerc sa schitez partea de admin a user-ilor. |
395 |
390 |
|
|
396 |
391 |
[ ] Do not pass a lot parameters in environment. Because of rights, we must |
[ ] Do not pass a lot parameters in environment. Because of rights, we must |
397 |
|
do a lookup in cache/db anyway. Or, compute correct rights (take in |
|
|
392 |
|
do a look-up in cache/db anyway. Or, compute correct rights (take in |
398 |
393 |
account IP/time/etc.). No, because we need paths. |
account IP/time/etc.). No, because we need paths. |
399 |
394 |
[ ] 'rg_rights_allow' needs a first parameter that is the set. |
[ ] 'rg_rights_allow' needs a first parameter that is the set. |
400 |
395 |
[ ] Repo rights were split in two. Check all rights checks! Maybe in check |
[ ] Repo rights were split in two. Check all rights checks! Maybe in check |
|
... |
... |
But, we have a problem with the expiration time! |
403 |
398 |
[ ] "Create repositories" user right should not be in repo rights? |
[ ] "Create repositories" user right should not be in repo rights? |
404 |
399 |
Probably not, because we may have no repo in the beginning. |
Probably not, because we may have no repo in the beginning. |
405 |
400 |
[ ] I will have a csv document with translations from where I will build |
[ ] I will have a csv document with translations from where I will build |
406 |
|
some hash tables for fast lookups. |
|
|
401 |
|
some hash tables for fast look-ups. |
407 |
402 |
[ ] Check "suspend"/"make admin"/etc. in admin area. Maybe use a checkbox and |
[ ] Check "suspend"/"make admin"/etc. in admin area. Maybe use a checkbox and |
408 |
403 |
an operation to avoid CSRF and to be consistent with ssh keys forms? |
an operation to avoid CSRF and to be consistent with ssh keys forms? |
409 |
404 |
[ ] Fix rights saga on user side. We may remove user_allow and replace with |
[ ] Fix rights saga on user side. We may remove user_allow and replace with |
|
... |
... |
But, we have a problem with the expiration time! |
431 |
426 |
rights! |
rights! |
432 |
427 |
[ ] Add "lock ip" to settings and use them as default. |
[ ] Add "lock ip" to settings and use them as default. |
433 |
428 |
Also use it for confirmation. |
Also use it for confirmation. |
434 |
|
But, if the IP changes, the user will have to relogin. Hm. |
|
|
429 |
|
But, if the IP changes, the user will have to re-login. Hm. |
435 |
430 |
[ ] The rights should be stored on different rows? Probably not. |
[ ] The rights should be stored on different rows? Probably not. |
436 |
431 |
[ ] Adding an account seems to just show "Account was created". |
[ ] Adding an account seems to just show "Account was created". |
437 |
432 |
Maybe redirect to user page? Only if there is no need to confirm. |
Maybe redirect to user page? Only if there is no need to confirm. |
|
... |
... |
But, we have a problem with the expiration time! |
457 |
452 |
Because the attack may come from several IPs, it is tempting to |
Because the attack may come from several IPs, it is tempting to |
458 |
453 |
use target user for rate limit. But, we will prevent legitimate users |
use target user for rate limit. But, we will prevent legitimate users |
459 |
454 |
to login. Maybe just increase the delay for login? Maybe notify user |
to login. Maybe just increase the delay for login? Maybe notify user |
460 |
|
how many attempts were before succesful login. |
|
|
455 |
|
how many attempts were before successful login. |
461 |
456 |
[ ] remote.php: call keys_update_use from an event. |
[ ] remote.php: call keys_update_use from an event. |
462 |
457 |
[ ] Allow user to change timezone! |
[ ] Allow user to change timezone! |
463 |
458 |
[ ] Prea mult spatiu gol la notificarea de schimbare repo. |
[ ] Prea mult spatiu gol la notificarea de schimbare repo. |
464 |
459 |
[ ] @@if: if after {{/}} follows a \n, just remove it? Maybe only if the if |
[ ] @@if: if after {{/}} follows a \n, just remove it? Maybe only if the if |
465 |
460 |
tokens are the only things on a line. |
tokens are the only things on a line. |
466 |
461 |
[ ] Think about moving unused tokens to a new session after login. |
[ ] Think about moving unused tokens to a new session after login. |
467 |
|
[ ] Security: Edit info: user can chage the uid behind my back in form! |
|
|
462 |
|
[ ] Security: Edit info: user can change the uid behind my back in form! |
468 |
463 |
This is fixed with rg_user_allow_access. It should be used everywhere. |
This is fixed with rg_user_allow_access. It should be used everywhere. |
469 |
464 |
[ ] Maybe do not deny account creation, but put them on a special state |
[ ] Maybe do not deny account creation, but put them on a special state |
470 |
465 |
and ask admin to allow it? |
and ask admin to allow it? |
|
... |
... |
But, we have a problem with the expiration time! |
474 |
469 |
[ ] Move sending e-mails to event. |
[ ] Move sending e-mails to event. |
475 |
470 |
[ ] Think about renaming repositories to projects. Because they contain also |
[ ] Think about renaming repositories to projects. Because they contain also |
476 |
471 |
the bug tracker. Maybe in the future the admin would want to disable |
the bug tracker. Maybe in the future the admin would want to disable |
477 |
|
some modules (git/bug tracket/etc.). |
|
478 |
|
[ ] When a push/etc. taskes places, add an event to recompute disk size! |
|
|
472 |
|
some modules (git/bug tracker/etc.). |
|
473 |
|
[ ] When a push/etc. takes places, add an event to recompute disk size! |
479 |
474 |
Then, remove this from cron. |
Then, remove this from cron. |
480 |
475 |
[ ] If user applies for open-source type account, do not allow private repos. |
[ ] If user applies for open-source type account, do not allow private repos. |
481 |
476 |
[ ] Move rg_account_allow_creation and other configuration stuff into admin area. |
[ ] Move rg_account_allow_creation and other configuration stuff into admin area. |
|
... |
... |
But, we have a problem with the expiration time! |
501 |
496 |
[ ] sess: just mark it as invalid and store it in cache to not connect to |
[ ] sess: just mark it as invalid and store it in cache to not connect to |
502 |
497 |
database? Cron will clean them up. |
database? Cron will clean them up. |
503 |
498 |
[ ] Transaction for bugs_max should be shorter. Now is very long. Hm. |
[ ] Transaction for bugs_max should be shorter. Now is very long. Hm. |
504 |
|
[ ] Protect sh scripts to be run as rocletgit user and not other. |
|
|
499 |
|
[ ] Protect sh scripts to be run as RocketGit user and not other. |
505 |
500 |
[ ] To not have too many keys in authorized_keys, investigate certificates. |
[ ] To not have too many keys in authorized_keys, investigate certificates. |
506 |
501 |
[ ] Add cache in: |
[ ] Add cache in: |
507 |
502 |
- rg_keys_count |
- rg_keys_count |
|
... |
... |
But, we have a problem with the expiration time! |
539 |
534 |
[ ] Export/import a repo (xml maybe). |
[ ] Export/import a repo (xml maybe). |
540 |
535 |
[ ] Add groups. |
[ ] Add groups. |
541 |
536 |
[ ] We should warn the user if some users have lower rights than the default! |
[ ] We should warn the user if some users have lower rights than the default! |
542 |
|
[ ] Auto-create repos at clonse phase, not only at push phase. |
|
|
537 |
|
[ ] Auto-create repos at clone phase, not only at push phase. |
543 |
538 |
[ ] The link to a note should have an anchor to be able to go directly to the note. |
[ ] The link to a note should have an anchor to be able to go directly to the note. |
544 |
539 |
[ ] bug tracker is private? If the repo is, it should be also. |
[ ] bug tracker is private? If the repo is, it should be also. |
545 |
540 |
[ ] When you watch a project, a note add to a bug will notify that watcher? |
[ ] When you watch a project, a note add to a bug will notify that watcher? |
|
... |
... |
But, we have a problem with the expiration time! |
554 |
549 |
[ ] Bug:List: saved searches with spaces inside the name are not correctly escaped. |
[ ] Bug:List: saved searches with spaces inside the name are not correctly escaped. |
555 |
550 |
Use _ instead of space, or properly escape it (ugly: %20 etc.)? |
Use _ instead of space, or properly escape it (ugly: %20 etc.)? |
556 |
551 |
[ ] "if ($res === FALSE) break" must set the error message! |
[ ] "if ($res === FALSE) break" must set the error message! |
557 |
|
[ ] Carefull order the events. We do not want to build list notifications |
|
|
552 |
|
[ ] Careful order the events. We do not want to build list notifications |
558 |
553 |
before adding a user to the watch list. |
before adding a user to the watch list. |
559 |
554 |
[ ] If description is empty, do not insert a \n in 'new repo' e-mail. |
[ ] If description is empty, do not insert a \n in 'new repo' e-mail. |
560 |
555 |
[ ] Current menu is not correctly shown as selected. |
[ ] Current menu is not correctly shown as selected. |
|
... |
... |
But, we have a problem with the expiration time! |
598 |
593 |
ignore request before that timestamp. |
ignore request before that timestamp. |
599 |
594 |
[ ] We should make stuff more robust. For example: CREATE REPO + HISTORY_INSERT. |
[ ] We should make stuff more robust. For example: CREATE REPO + HISTORY_INSERT. |
600 |
595 |
[ ] We have to record the renaming in the repo history. |
[ ] We have to record the renaming in the repo history. |
601 |
|
[ ] What happends if a user is doing a downgrade? Must not allow it. |
|
|
596 |
|
[ ] What happens if a user is doing a downgrade? Must not allow it. |
602 |
597 |
[ ] Use another home page for logged in users. |
[ ] Use another home page for logged in users. |
603 |
598 |
[ ] repo_invalidate_cache does an implode that can reorder. Use repo_id as key? |
[ ] repo_invalidate_cache does an implode that can reorder. Use repo_id as key? |
604 |
599 |
No. But use some combinations of paras. |
No. But use some combinations of paras. |
|
... |
... |
But, we have a problem with the expiration time! |
620 |
615 |
[ ] Move everything 1 month back to simulate next month for slave tables. |
[ ] Move everything 1 month back to simulate next month for slave tables. |
621 |
616 |
Better, do a unit test. |
Better, do a unit test. |
622 |
617 |
[ ] To not wake up many times (for every sub-event), cache what was done |
[ ] To not wake up many times (for every sub-event), cache what was done |
623 |
|
(or max(id)) and ignore that wakeups. Of course, W will become W<ev_id>. |
|
|
618 |
|
(or max(id)) and ignore that wake-ups. Of course, W will become W<ev_id>. |
624 |
619 |
[ ] If session expired and the user is trying to access a repo page, PHP errors |
[ ] If session expired and the user is trying to access a repo page, PHP errors |
625 |
|
occures. I think is related to login_ui/repo_ui. |
|
|
620 |
|
occurs. I think is related to login_ui/repo_ui. |
626 |
621 |
[ ] Unify repo_create with repo_update, as user_*. |
[ ] Unify repo_create with repo_update, as user_*. |
627 |
622 |
[ ] Clean notification inputs before starting to work to not receive a lot of |
[ ] Clean notification inputs before starting to work to not receive a lot of |
628 |
623 |
them after processing is done. |
them after processing is done. |
629 |
624 |
[ ] Description should not be present anywhere (web). Takes space. |
[ ] Description should not be present anywhere (web). Takes space. |
630 |
625 |
[ ] Seems that ls \.\. works. Check from security pov. |
[ ] Seems that ls \.\. works. Check from security pov. |
631 |
|
[ ] Profiling in not reentrant. We should use a stack! |
|
|
626 |
|
[ ] Profiling in not re-entrant. We should use a stack! |
632 |
627 |
[ ] We should not store repo_id0 into cache! |
[ ] We should not store repo_id0 into cache! |
633 |
628 |
[ ] We are redirecting the user to history page. Do not wait for git dir! |
[ ] We are redirecting the user to history page. Do not wait for git dir! |
634 |
629 |
[ ] Set a policy in config.php and do the cleaning/compress of the log files. |
[ ] Set a policy in config.php and do the cleaning/compress of the log files. |
|
... |
... |
them after processing is done. |
645 |
640 |
Also define global templates. |
Also define global templates. |
646 |
641 |
[ ] GeoIP |
[ ] GeoIP |
647 |
642 |
[ ] Specify a timeout for push/fetch. |
[ ] Specify a timeout for push/fetch. |
648 |
|
[ ] Describe also the instalation. |
|
|
643 |
|
[ ] Describe also the installation. |
649 |
644 |
[ ] Allow search from the first page. |
[ ] Allow search from the first page. |
650 |
645 |
[ ] Send notifications when a user is given rights to a repo. |
[ ] Send notifications when a user is given rights to a repo. |
651 |
646 |
[ ] Detect hexa strings and link them to commits. |
[ ] Detect hexa strings and link them to commits. |
|
... |
... |
them after processing is done. |
712 |
707 |
Also, present a list with checkboxex: at least Signoff-by, Reported-by, Acked-by! |
Also, present a list with checkboxex: at least Signoff-by, Reported-by, Acked-by! |
713 |
708 |
[ ] Linus on why GitHub sucks: https://github.com/torvalds/linux/pull/17#issuecomment-5654674 |
[ ] Linus on why GitHub sucks: https://github.com/torvalds/linux/pull/17#issuecomment-5654674 |
714 |
709 |
[ ] Warn if commit messages are too long (no wrap). |
[ ] Warn if commit messages are too long (no wrap). |
715 |
|
[ ] Allow the possibility to send an e-mail to mainteiner from web with a pull request |
|
|
710 |
|
[ ] Allow the possibility to send an e-mail to maintainer from web with a pull request |
716 |
711 |
[ ] Check https://github.com/torvalds/linux/pull/17#issuecomment-5654674 |
[ ] Check https://github.com/torvalds/linux/pull/17#issuecomment-5654674 |
717 |
712 |
[ ] Merge requests e-mail: explanation of why to pull, diffstat! Maybe also the |
[ ] Merge requests e-mail: explanation of why to pull, diffstat! Maybe also the |
718 |
713 |
patch if is small. |
patch if is small. |
|
... |
... |
them after processing is done. |
729 |
724 |
[ ] rg_redirect does not record profiling information! |
[ ] rg_redirect does not record profiling information! |
730 |
725 |
[ ] git bundle |
[ ] git bundle |
731 |
726 |
[ ] How to sign merge requests?! |
[ ] How to sign merge requests?! |
732 |
|
[ ] Store in a cookie the last uid used, and if > 0, lookup e-mail and prefill |
|
|
727 |
|
[ ] Store in a cookie the last uid used, and if > 0, look-up e-mail and pre-fill |
733 |
728 |
forgot password e-mail field. Not good. An attacker may iterate over all |
forgot password e-mail field. Not good. An attacker may iterate over all |
734 |
729 |
uids. But, with a token will be nice! |
uids. But, with a token will be nice! |
735 |
730 |
[ ] Yeah BitBucket's pricing is much better they only charge on the number of collaborators. |
[ ] Yeah BitBucket's pricing is much better they only charge on the number of collaborators. |
|
... |
... |
them after processing is done. |
748 |
743 |
[ ] Add a dependency on sendmail. |
[ ] Add a dependency on sendmail. |
749 |
744 |
[ ] Improve e-mails to not be considered spam. |
[ ] Improve e-mails to not be considered spam. |
750 |
745 |
[ ] Statistics (number, tool etc.) for project access. |
[ ] Statistics (number, tool etc.) for project access. |
751 |
|
[ ] For bugtracker use BerliOS as a starting point. |
|
|
746 |
|
[ ] For bug-tracker use BerliOS as a starting point. |
752 |
747 |
[ ] Allow (anonymous) editing files on web and transform them in merge request. |
[ ] Allow (anonymous) editing files on web and transform them in merge request. |
753 |
748 |
How to bundle multiple edits in a single commit? |
How to bundle multiple edits in a single commit? |
754 |
749 |
[ ] On the first page no search form! It is useless! |
[ ] On the first page no search form! It is useless! |
|
... |
... |
them after processing is done. |
791 |
786 |
[ ] "Lock" button to temporary block access to repository. |
[ ] "Lock" button to temporary block access to repository. |
792 |
787 |
Only owner will have access. |
Only owner will have access. |
793 |
788 |
We may add also a text that will be output to clients. |
We may add also a text that will be output to clients. |
794 |
|
[ ] List chages introduced by a merge: git diff-tree --always [--cc] -m -p f7d5b5770f4c6b5a124dad6358bed310d56bf909 |
|
|
789 |
|
[ ] List changes introduced by a merge: git diff-tree --always [--cc] -m -p f7d5b5770f4c6b5a124dad6358bed310d56bf909 |
795 |
790 |
[ ] Check pack-protocol.txt! |
[ ] Check pack-protocol.txt! |
796 |
791 |
[ ] When push is executed with success, show a nice message from RocketGit. |
[ ] When push is executed with success, show a nice message from RocketGit. |
797 |
792 |
[ ] Move is_private member in repo array, not test for empty on default rights |
[ ] Move is_private member in repo array, not test for empty on default rights |
|
... |
... |
them after processing is done. |
832 |
827 |
multiple instances of rocketgit on the same server. |
multiple instances of rocketgit on the same server. |
833 |
828 |
[ ] Smart HTTP transport |
[ ] Smart HTTP transport |
834 |
829 |
[ ] Move forget pass token into users table. |
[ ] Move forget pass token into users table. |
835 |
|
[ ] Audit all error messages to not propage usefull info to an attacker. |
|
|
830 |
|
[ ] Audit all error messages to not propagate useful info to an attacker. |
836 |
831 |
Split in two error messages: one for logs and one for user. |
Split in two error messages: one for logs and one for user. |
837 |
832 |
[ ] git-daemon connection - cannot get IP info? setenv? |
[ ] git-daemon connection - cannot get IP info? setenv? |
838 |
|
[ ] Do not show submenus if user is not logged in on repopage (ialbeascu) |
|
|
833 |
|
[ ] Do not show sub-menus if user is not logged in on repopage (ialbeascu) |
839 |
834 |
- duplicate menus?! maybe add an admin link in repopage that goes |
- duplicate menus?! maybe add an admin link in repopage that goes |
840 |
835 |
to repo. |
to repo. |
841 |
836 |
[ ] Nice graphic (unrelated to git): http://tctechcrunch2011.files.wordpress.com/2011/07/hadoop2.png?w=640 |
[ ] Nice graphic (unrelated to git): http://tctechcrunch2011.files.wordpress.com/2011/07/hadoop2.png?w=640 |
|
... |
... |
them after processing is done. |
863 |
858 |
[ ] To investigate how gitolite is dealing with pushes without custom daemon. |
[ ] To investigate how gitolite is dealing with pushes without custom daemon. |
864 |
859 |
[ ] Record in notes who pushed a commit first, for trace reasons? |
[ ] Record in notes who pushed a commit first, for trace reasons? |
865 |
860 |
[ ] Add support for hooks/pre-receive-signature |
[ ] Add support for hooks/pre-receive-signature |
866 |
|
[ ] Work flows: Allow user to edit workflows. For example: |
|
|
861 |
|
[ ] Work flows: Allow user to edit work-flows. For example: |
867 |
862 |
- A merge request that is approved in a MR queue will make it |
- A merge request that is approved in a MR queue will make it |
868 |
863 |
automatically to the specified queues. |
automatically to the specified queues. |
869 |
864 |
[ ] At push time we may generate some nice informative output (commits, |
[ ] At push time we may generate some nice informative output (commits, |
|
... |
... |
them after processing is done. |
872 |
867 |
|
|
873 |
868 |
== Low priority == |
== Low priority == |
874 |
869 |
[ ] If a user has no push access and creates merge request, but the owner pushed |
[ ] If a user has no push access and creates merge request, but the owner pushed |
875 |
|
nothing, ssh cloning gives erros about HEAD not found. |
|
|
870 |
|
nothing, ssh cloning gives errors about HEAD not found. |
876 |
871 |
|
|
877 |
872 |
|
|
878 |
873 |
== Graphics == |
== Graphics == |