From 070f43353d12300b0d2564c4d11c18a25b3f6615 Mon Sep 17 00:00:00 2001 From: Philippe Ombredanne Date: Wed, 9 Nov 2022 10:41:17 +0100 Subject: [PATCH 1/4] Remove unused setting variable Signed-off-by: Philippe Ombredanne --- vulnerablecode/settings.py | 4 ---- 1 file changed, 4 deletions(-) diff --git a/vulnerablecode/settings.py b/vulnerablecode/settings.py index 6ad02f61f..0d6b2f88c 100644 --- a/vulnerablecode/settings.py +++ b/vulnerablecode/settings.py @@ -34,10 +34,6 @@ ALLOWED_HOSTS = env.list("ALLOWED_HOSTS", default=[".localhost", "127.0.0.1", "[::1]"]) -VULNERABLECODE_REQUIRE_AUTHENTICATION = env.bool( - "VULNERABLECODE_REQUIRE_AUTHENTICATION", default=False -) - VULNERABLECODE_PASSWORD_MIN_LENGTH = env.int("VULNERABLECODE_PASSWORD_MIN_LENGTH", default=14) # SECURITY WARNING: do not run with debug turned on in production From 9933374bd2bd8eda4e250cd3fb3e99efb01e454b Mon Sep 17 00:00:00 2001 From: Philippe Ombredanne Date: Wed, 9 Nov 2022 10:51:34 +0100 Subject: [PATCH 2/4] Add CSRF_TRUSTED_ORIGINS to setting This is needed for effective CSRF proptection on deployments Signed-off-by: Philippe Ombredanne --- vulnerablecode/settings.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/vulnerablecode/settings.py b/vulnerablecode/settings.py index 0d6b2f88c..0b94c13d7 100644 --- a/vulnerablecode/settings.py +++ b/vulnerablecode/settings.py @@ -36,6 +36,8 @@ VULNERABLECODE_PASSWORD_MIN_LENGTH = env.int("VULNERABLECODE_PASSWORD_MIN_LENGTH", default=14) +CSRF_TRUSTED_ORIGINS = env.list("CSRF_TRUSTED_ORIGINS", default=[]) + # SECURITY WARNING: do not run with debug turned on in production DEBUG = env.bool("VULNERABLECODE_DEBUG", default=False) From 574fcd46165d0c16351b4397d29e07954ae4eecf Mon Sep 17 00:00:00 2001 From: Philippe Ombredanne Date: Wed, 9 Nov 2022 10:59:20 +0100 Subject: [PATCH 3/4] Bump version Signed-off-by: Philippe Ombredanne --- CHANGELOG.rst | 11 +++++++++++ setup.cfg | 2 +- vulnerablecode/__init__.py | 2 +- 3 files changed, 13 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.rst b/CHANGELOG.rst index 56beed61a..18ada8af3 100644 --- a/CHANGELOG.rst +++ b/CHANGELOG.rst @@ -3,9 +3,20 @@ Release notes +Version v30.3.1 +---------------- + +This is a minor bug fix release. + +- We enabled proper CSRF configuration for deployments + + Version v30.3.0 ---------------- +This is a feature update release including minor bug fixes and the introduction +of API keys and API throttling. + - We enabled API throttling for a basic user and for a staff user they can have unlimited access on API. diff --git a/setup.cfg b/setup.cfg index dd849fad6..58bb94765 100644 --- a/setup.cfg +++ b/setup.cfg @@ -1,6 +1,6 @@ [metadata] name = vulnerablecode -version = 30.3.0 +version = 30.3.1 license = Apache-2.0 AND CC-BY-SA-4.0 # description must be on ONE line https://github.com/pypa/setuptools/issues/1390 diff --git a/vulnerablecode/__init__.py b/vulnerablecode/__init__.py index e415fce2e..b45be9eb1 100644 --- a/vulnerablecode/__init__.py +++ b/vulnerablecode/__init__.py @@ -12,7 +12,7 @@ import warnings from pathlib import Path -__version__ = "30.3.0" +__version__ = "30.3.1" def command_line(): From 2c29973cc5bb09db3211e5172875217feeb07d6b Mon Sep 17 00:00:00 2001 From: Philippe Ombredanne Date: Wed, 9 Nov 2022 11:28:58 +0100 Subject: [PATCH 4/4] Improve API request email * Enhance the email message content. * Streamline About content in web UI. * Format code and fix typos. Signed-off-by: Philippe Ombredanne --- vulnerabilities/templates/navbar.html | 16 ++++++------- vulnerabilities/views.py | 33 ++++++++++++++++++++++++--- 2 files changed, 38 insertions(+), 11 deletions(-) diff --git a/vulnerabilities/templates/navbar.html b/vulnerabilities/templates/navbar.html index 0210e8ef1..2f6bac32a 100644 --- a/vulnerabilities/templates/navbar.html +++ b/vulnerabilities/templates/navbar.html @@ -44,24 +44,24 @@