Roundup Tracker - Issues

Issue 2550953

classification
Patch: fix for context.is_view_ok check in jinja2 template
Type: security Severity: major
Components: Web interface Versions: devel
process
Status: fixed fixed
:
: rouilj : rouilj, tonich
Priority: normal : jinja2, patch

Created on 2017-09-21 19:12 by tonich, last changed 2017-09-25 23:29 by rouilj.

Files
File name Uploaded Description Edit Remove
roundup-jinja2.patch tonich, 2017-09-21 19:12
Messages
msg6019 Author: [hidden] (rouilj) Date: 2017-09-24 02:54
Tonich, could you describe the problem you are trying to fix?

It looks like you are adding () after the is_view_ok statement.
I see the same used in:

  issue.index.html:  {% if context.is_view_ok %}

although most of the uses are the ()'ed form.

I don't know jinja, but in tal you don't need the ()'s
in some of it's evaluation modes. I don't know if jinja
has something similar or if that is the only way it will
work.

So some explanation here would be helpful.

We have had people try the jinja template and found it lacking,
so I would like to improve it.

Thanks.

-- rouilj
msg6020 Author: [hidden] (tonich) Date: 2017-09-25 18:32
I tried to disable all permissions for anonymous access, but still saw
some form controls on the page. The classic template works fine without
anonymous access rights.
msg6021 Author: [hidden] (rouilj) Date: 2017-09-25 23:29
I applied the patch. The is_view_ok() I have no questions about.
I assume you moved the rest of the logic to encompass the whole page.

Patch is in: rev:6b87c06e0e0c
History
Date User Action Args
2017-09-25 23:29:59rouiljsetpriority: normal
2017-09-25 23:29:48rouiljsetkeywords: + jinja2
2017-09-25 23:29:32rouiljsetstatus: new -> fixed
assignee: rouilj
messages: + msg6021
resolution: fixed
type: security
2017-09-25 18:32:31tonichsetnosy: + tonich
messages: + msg6020
2017-09-24 02:54:15rouiljsetnosy: + rouilj
messages: + msg6019
2017-09-21 19:12:34tonichcreate