607 Commits

Author SHA1 Message Date
Pedro Ferreira
39fd3066d9 Remove Cloudflare's CDN from whitelist
Angular + Prototype are exploitable when together :/
2016-02-12 10:19:46 +01:00
Pedro Ferreira
9413a611a9 Make MathJax work without unsafe-eval
Once again, possible XSS attack vector.
2016-02-11 17:55:35 +01:00
Pedro Ferreira
d1417a413d Jupyter: Stricter CSP - disallow local JS
Users can add JS as attachments, which will be executed. Would allow XSS
from malicious users.
2016-02-10 17:13:19 +01:00
Adrian Moennich
4ed19485ec VC/Vidyo: Fix zeroclipboard-init class 2016-01-05 09:32:04 +01:00
Adrian Moennich
de84394af0 VC/Vidyo: Hide PIN row if no PIN is set 2016-01-05 09:21:40 +01:00
Pedro Ferreira
8363ba54d7 Jupyter: use flask instead of old responseUtil 2015-12-09 11:57:30 +01:00
Pedro Ferreira
4e9f079c71 Jupyter: added default sane MathJax config
Won't work without unsafe-eval CSP :/
2015-12-09 11:48:46 +01:00
Adrian Moennich
c1a436524a Payment/PayPal: Adapt payment template folder 2015-11-17 11:41:53 +01:00
Adrian Moennich
5c737fa3f4 Payment/PayPal: Use generic message_box macro 2015-11-17 11:32:10 +01:00
Michal Kolodziejski
ea6038851b Adapt payment module imports 2015-11-17 11:32:10 +01:00
Alejandro Avilés
ca02fed62b Payment/PayPal: Verify currency as well 2015-11-16 15:17:31 +01:00
Alejandro Avilés
fde2bee126 Payment/PayPal: Fix url prefix 2015-11-12 11:14:42 +01:00
Adrian Moennich
30c475c594 Payment/PayPal: Include event id in invoice string 2015-11-05 15:37:55 +01:00
Pedro Ferreira
2c57702a57 Jupyter Previewer: Added CSP headers 2015-11-03 17:50:30 +01:00
Adrian Moennich
818a454f31 Update travis config
- container infrastructure
- postgres 9.4
2015-10-27 20:09:55 +01:00
Adrian Moennich
5817a951c7 Payment/PayPal: Fix tests 2015-10-27 19:55:30 +01:00
Alejandro Avilés
9511b43539 Payment/PayPal: Fix callbacks 2015-10-27 19:27:50 +01:00
Adrian Moennich
040d275d1d Payment/PayPal: Fix unit tests 2015-10-27 17:20:30 +01:00
Alejandro Avilés
5c124740c0 Payment/Paypal: Adapt to new registration module 2015-10-27 17:20:30 +01:00
Pedro Ferreira
d2b05cd2c3 Livesync: Upload metadata records in batches
Until now we were fetching livesync queue entries in batches but the resulting number of actual resulting records could be much higher
2015-10-05 17:20:28 +02:00
Pedro Ferreira
7a1046a22b Added Jupyter Notebook previewer 2015-09-30 16:03:01 +02:00
Pedro Ferreira
6fd1ec7e30 Added Pygments-based source file previewer 2015-09-30 16:03:00 +02:00
Adrian Moennich
557bd540d9 Chat: Use nicer menu entry name 2015-09-30 15:27:48 +02:00
Adrian Moennich
23bf1380d2 Piwik: Mark sidemenu entry as active 2015-09-30 15:25:28 +02:00
Adrian Moennich
e3e10c8d3e Payment/PayPal: Fix failing tests 2015-09-29 17:55:28 +02:00
Adrian Moennich
dee1953652 Adapt to menu changes (argument instead of tuple) 2015-09-29 17:52:42 +02:00
Adrian Moennich
8d3eb9f970 LiveSync: Handle acl.entry_changed signal
Used for manager list changes
2015-09-29 17:52:42 +02:00
Adrian Moennich
f667743d2d VC/Vidyo: Use can_manage instead of canModify 2015-09-28 15:10:58 +02:00
Adrian Moennich
ae93c2707c Use new Event object in menu signals 2015-09-28 14:53:40 +02:00
Pedro Ferreira
a88530a640 Moved plugins to new menu sections
Also fixed a couple of small issues
2015-09-28 14:37:00 +02:00
Adrian Moennich
8604a7f459 Chat: Use event_id FK 2015-09-24 13:32:08 +02:00
Pedro Ferreira
7e261a07f3 PayPal: allow for no business id
Weird that PayPal does this, but apparently some messages come without it.
2015-09-21 16:25:35 +02:00
Pedro Ferreira
d0ef6cb677 Put menu items into sections 2015-09-02 18:00:08 +02:00
Adrian Moennich
228988ffb8 Chat: Remove legacy event id checks 2015-09-02 13:26:41 +02:00
Pedro Ferreira
0617104f59 'zeroclicboard' -> 'zeroclipboard' 2015-08-28 15:35:19 +02:00
Adrian Moennich
d315dc4982 Search: Use new is_searchable setting 2015-08-27 09:21:29 +02:00
Jacques Dafflon
0113650a78 Chat: Adapt to event menu changes 2015-08-21 14:39:47 +02:00
Adrian Moennich
1942c3084d Importer: Handle empty material name more gracefully 2015-07-21 17:05:40 +02:00
Adrian Moennich
f608f004d2 Chat: Flush before sending attachment_created 2015-07-21 15:25:47 +02:00
Adrian Moennich
5782b9ee6f Piwik: Do not track attachment downloads from preview
We already tracked it when opening the preview
2015-07-17 17:55:36 +02:00
Alejandro Avilés
0693b91093 Piwik: Fetch material list from new backend 2015-07-16 15:28:31 +02:00
Adrian Moennich
a5eda594b6 Piwik: Honor the enabled_for_downloads setting 2015-07-10 10:45:29 +02:00
Adrian Moennich
9c1a0c3f2e Chat: Use new secure_filename 2015-07-09 11:51:47 +02:00
Pedro Ferreira
e563a0c24c Removed unwanted cast 2015-07-08 23:56:31 +02:00
Adrian Moennich
07e7da5739 LiveSync: Subscribe to attachment signals 2015-07-08 22:48:02 +02:00
Adrian Moennich
95a0f3ba22 LiveSync/Debug: Fix debug output 2015-07-08 22:48:02 +02:00
Adrian Moennich
c529ff389c Chat: Proper AJAX error/progress display 2015-07-07 18:32:32 +02:00
Adrian Moennich
81cbd97484 Chat: Adapt to new attachment system 2015-07-07 18:32:23 +02:00
Jacques Dafflon
87bfd3924e Chat: Fix icon's name from icomoon 2015-07-07 12:02:26 +02:00
Alejandro Avilés
1464354081 LiveSync: Connect with note signals 2015-07-07 11:03:08 +02:00