|
|
Mads Kiilerich
|
2e1059de6751
|
3 years ago
|
|
repo groups: make it possible to remove own explicit permissions, now when group owners always have admin permissions
Until recently, group owners very given explicit admin permissions on repo group, and special care was taken to make sure they didn't remove themselves.
Now we always give admin permissions to owners, and don't care about the explicit permissions. We no longer add them when creating groups or changing owner. There is no migration step to remove redundant permissions, but we should allow group admins to remove them. This change will thus remove the mechanism for preventing removal of own/owner permissions.
|
|
|
Mads Kiilerich
|
abc29122c7f2
|
3 years ago
|
|
repo group: introduce editing of owner
The repo group owner concept was only partially implemented. Owners were shown in the repo group listing, but couldn't be changed. Users owning repo groups couldn't be deleted, with no other solution than deleting owned repo groups.
This also fixes the existing broken update_repo_group API, which tried to use unimplemented functionality.
|
|
|
Thomas De Schampheleire
|
ee1da602b590
|
4 years ago
|
|
repo_groups: fix deletion of subgroups Deletion of a repository group that has a parent group (i.e. is not at the root of the repository group tree) failed as follows: Traceback (most recent call last): [...] File ".../lib/python3.9/site-packages/tg/configurator/components/dispatch.py", line 114, in _call_controller return controller(*remainder, **params) File "<decorator-gen-5>", line 2, in delete File "/home/tdescham/repo/contrib/kallithea/kallithea-release/kallithea/lib/auth.py", line 572, in __wrapper return func(*fargs, **fkwargs) File "/home/tdescham/repo/contrib/kallithea/kallithea-release/kallithea/controllers/admin/repo_groups.py", line 271, in delete if gr.parent_group: File ".../lib/python3.9/site-packages/sqlalchemy/orm/attributes.py", line 294, in __get__ return self.impl.get(instance_state(instance), dict_) File ".../lib/python3.9/site-packages/sqlalchemy/orm/attributes.py", line 730, in get value = self.callable_(state, passive) File ".../lib/python3.9/site-packages/sqlalchemy/orm/strategies.py", line 717, in _load_for_state raise orm_exc.DetachedInstanceError( sqlalchemy.orm.exc.DetachedInstanceError: Parent instance <RepoGroup at 0x7f1f2664f4c0> is not bound to a Session; lazy load operation of attribute 'parent_group' cannot proceed (Background on this error at: http://sqlalche.me/e/13/bhk3) In the reference 'gr.parent_group', 'gr' is an SQLAlchemy object referring to the group being deleted, and 'gr.parent_group' is a lazy reference to its parent group. The 'lazy' means that the parent group object is not loaded automatically when 'gr' is assigned, but instead will be loaded on-the-fly when the parent group is actually accessed. See [1] and [2] for more information. The problem was that the lazy 'parent_group' attribute was accessed _after_ deleting the database object it was part of. Fix this by obtaining a handle to the parent group _before_ deleting the subgroup. Reported-by: André Klitzing (via mailing list) [1] https://docs.sqlalchemy.org/en/13/errors.html#error-bhk3[2] https://docs.sqlalchemy.org/en/13/orm/loading_relationships.html
|
|
|
Mads Kiilerich
|
a36a8804e7be
|
5 years ago
|
|
|
|
|
Mads Kiilerich
|
4f0de9468da3
|
5 years ago
|
|
controllers: move controllers base class from lib/base to controllers
TG quickstart put it in lib/base.py , but it fits better on the controllers layer as a base there.
The contributing docs were a bit ahead of time ... but with a typo.
|
|
|
Mads Kiilerich
|
7c541dc095c8
|
5 years ago
|
|
lib: clean up pointless use of h.person on db.User just to get .username
After cleaning up, h.person will never be invoked with a db.User .
|
|
|
Mads Kiilerich
|
7b7afdbe57af
|
5 years ago
|
|
|
|
|
Mads Kiilerich
|
2a2a50e10026
|
5 years ago
|
|
repo_groups: fix select of parent group when adding repo group
h.select was passed a list of repo groups where group_id was integer, but parent_group in the request was a string - thus no match.
Do as in repos controller create_repository (and in error handling): leave it to htmlfill to patch up the generated HTML using defaults ... but make sure we always have a default.
|
|
|
Mads Kiilerich
|
df930758dcf7
|
5 years ago
|
|
repos: extra HTML escaping of repo and repo group names shown in DataTables
These names will already have been "slugged" and can thus not contain anything that can be used for any attack. But let's be explicitly safe and escape them anyway.
raw_name without escaping would cause XSS *if* it was possible to create unsafe repo names.
just_name must be escaped in order to make search work correctly - for example if searching for '<' ... *if* it was possible for names to contain that.
|
|
|
Mads Kiilerich
|
6a9e5841cc51
|
5 years ago
|
|
lib: consistently import helpers the same way
Make it easier to grep for any remaining potential layering-violating use of helpers.
|
|
|
Mads Kiilerich
|
67e5b90801aa
|
5 years ago
|
|
lib: move webhelpers2 and friends to webutils
Gives less of the unfortunate use of helpers - especially in low level libs.
|
|
|
Mads Kiilerich
|
b9b53e25a08d
|
5 years ago
|
|
lib: fix bad references to utils3 A problem introduced in when rebasing 5e46f73f0d1c after renaming the temporary utils3 name to webutils.
|
|
|
Mads Kiilerich
|
5e46f73f0d1c
|
5 years ago
|
|
|
|
|
Mads Kiilerich
|
b095e2fbba44
|
5 years ago
|
|
|
|
|
Mads Kiilerich
|
0be48652ca48
|
5 years ago
|
|
routing: separate url handling from routing - move it to webutils
This is a helper method relying on the thread local tg.request. We didn't have a good place to put it. Now we do.
This (re)moves unfortunate dependencies to the routing module (which almost is a controller).
|
|
|
Mads Kiilerich
|
c19e720cbb21
|
6 years ago
|
|
|
|
|
Mads Kiilerich
|
5725fa4cfecd
|
6 years ago
|
|
cleanup: minimize use of lambda expressions - we have 'def' for that purpose
Fix some flake8 warnings "E731 do not assign a lambda expression, use a def".
|
|
|
Mads Kiilerich
|
b6b6955981a5
|
6 years ago
|
|
|
|
|
Mads Kiilerich
|
e35373106528
|
6 years ago
|
|
py3: remove safe_unicode in places where it no longer is needed because all strings (except bytes) already *are* unicode strings
(The remaining safe_unicode calls are still needed and can't just be removed, generally because we in these cases still have to convert from bytes to unicode strings.)
|
|
|
Thomas De Schampheleire
|
24db2cd42881
|
6 years ago
|
|
|
|
|
Mads Kiilerich
|
95ca00cd722f
|
6 years ago
|
|
cleanup: minor correctness fixes
"Trivial" potential problems spotted with pytype.
|
|
|
Mads Kiilerich
|
67eeb02062fe
|
6 years ago
|
|
controllers: use unicode for internal rendering of template snippets Like 8e2313be042d.
|
|
|
Mads Kiilerich
|
ed78b4fbe2a3
|
6 years ago
|
|
|
|
|
Mads Kiilerich
|
e8e9f33e9ff6
|
6 years ago
|
|
py3: use comprehensions and generators instead of filters - it is more explicit, and sometimes shorter
From 2to3 -f filter.
|
|
|
Mads Kiilerich
|
ce5d4c582a82
|
6 years ago
|
|
py3: cleanup map usage and avoid py3 ambiguity
Based on 2to3 -f map ... but replace map with something more explicit (unless born and raised in a lisp world) (but sometimes slightly more verbose).
|
|
|
Mads Kiilerich
|
fe4086096758
|
6 years ago
|
|
|
|
|
Mads Kiilerich
|
0a277465fddf
|
6 years ago
|
|
|
|
|
Mads Kiilerich
|
af938280e76a
|
8 years ago
|
|
|
|
|
Mads Kiilerich
|
aa25ef34ebab
|
8 years ago
|
|
auth: refactor to introduce @LoginRequired(allow_default_user=True) and deprecate @NotAnonymous() It was error prone that @LoginRequired defaulted to allow anonymous users (if 'default' user is enabled). See also 245b4e3abf39. Refactor code to make it more explicit and safe by default: Deprecate @NotAnonymous by making it the default of @LoginRequired. That will make it safe by default. To preserve same functionality, set allow_default_user=True in all the cases where @LoginRequired was *not* followed by @NotAnonymous or other permission checks - that was done with some script hacks: sed -i 's/ @LoginRequired(\(..*\))/ @LoginRequired(\1, allow_default_user=True)/g' `hg mani` sed -i 's/ @LoginRequired()/ @LoginRequired(allow_default_user=True)/g' `hg mani` perl -0pi -e 's/\ @LoginRequired\(allow_default_user=True\)\n\s*\ @NotAnonymous\(\)/\ @LoginRequired()/g' `hg mani` perl -0pi -e 's/\ @LoginRequired\(allow_default_user=True\)(\n\s*\ @Has(Repo)?Permission)/\ @LoginRequired()\1/g' `hg mani` It has been reviewed that all uses of allow_default_user=True are in places where the there indeed wasn't any checking for default user before. These may or may not be correct, but now they are explicit and can be spotted and fixed. The few remaining uses of @NotAnonymous should probably be removed somehow.
|
|
|
domruf
|
205daed7185b
|
8 years ago
|
|
users: remove code that is unused after most autocomplete has been switched to ajax
@mention support still require _USERS_AC_DATA as a global variable.
|
|
|
Mads Kiilerich
|
6db3122e4d75
|
8 years ago
|
|
index: show repositories and repository groups in the same table
Having two different tables with their own paging and search gave a bad UI. Instead, do like all other UIs that show directory content and show both "folders" and "files" in the same list.
The rendering of repo groups is changed to use js data instead of a taking data from an html table.
Repository groups are shoe-horned into the repository DataTable. The columns are no perfect match - some of the existing columns are thus given an empty default value.
|
|
|
Mads Kiilerich
|
e81332582fc9
|
8 years ago
|
|
controllers: drop unused totalRecords and startIndex
We don't want it just for testing.
|
|
|
Lars Kruse
|
7691290837d2
|
8 years ago
|
|
codingstyle: trivial whitespace fixes
Reported by flake8.
|
|
|
Alessandro Molina
|
e1ab82613133
|
9 years ago
|
|
backend: replace Pylons with TurboGears2 Replace the no-longer-supported Pylons application framework by TurboGears2 which is largely compatible/similar to Pylons. Some interesting history is described at: https://en.wikipedia.org/wiki/TurboGearsChanges by Dominik Ruf: - fix sql config in test.ini Changes by Thomas De Schampheleire: - set-up of test suite - tests: 'fix' repo archival test failure Between Pylons and TurboGears2, there seems to be a small difference in the headers sent for repository archive files, related to character encoding. It is assumed that this difference is not important, and that the test should just align with reality. - remove need to import helpers/app_globals in lib TurboGears2 by default expects helpers and app_globals to be available in lib. For this reason kallithea/lib/__init__.py was originally changed to include those files. However, this triggered several types of circular import problems. If module A imported something from lib (e.g. lib.annotate), and lib.helpers imported (possibly indirectly) module A, then there was a circular import. Fix this by overruling the relevant method of tg AppConfig, which is also hinted in the TurboGears2 code. Hereby, the include of something from lib does not automatically import helpers, greatly reducing the chances of circular import problems. - make sure HTTP error '400' uses the custom error pages TurboGears2 does not by default handle HTTP status code '400 (Bad Request)' via the custom error page handling, causing a standard non-styled error page. - disable transaction manager Kallithea currently handles its own transactions and does not need the TurboGears2 transaction manager. However, TurboGears2 tries to enable it by default and fails, throwing an error during application initialization. The error itself seemed to be harmless for normal application functioning, but was nevertheless confusing. - add backlash as required dependency: backlash is meant as the WebError replacement in TurboGears2 (originally WebError is part of Pylons). When debug==true, it provides an interactive debugger in the browser. When debug==false, backlash is necessary to show backtraces on the console. - misc fixes
|
|
|
Thomas De Schampheleire
|
4517e212f09a
|
9 years ago
|
|
controllers: rename __before__ to _before in preparation of TurboGears2
__before__ in Pylons is called _before in TurboGears2. We can prepare this rename already in Pylons-based Kallithea, so that the real TG2 migration commit just changes the BaseController.
Since TurboGears2 _before can pass extra arguments, we add *args and **kwargs parameters as well.
|
|
|
Mads Kiilerich
|
e9ac5698281d
|
9 years ago
|
|
tg: minimize future diff by some mocking and replacing some pylons imports with tg
No actual tg dependency yet, just a temporary hack faking tg as an alias for pylons.
Based on work by Alessandro Molina.
|
|
|
Søren Løvborg
|
33b71a130b16
|
9 years ago
|
|
templates: properly escape inline JavaScript values
TLDR: Kallithea has issues with escaping values for use in inline JS. Despite judicious poking of the code, no actual security vulnerabilities have been found, just lots of corner-case bugs. This patch fixes those, and hardens the code against actual security issues.
The long version:
To embed a Python value (typically a 'unicode' plain-text value) in a larger file, it must be escaped in a context specific manner. Example:
>>> s = u'<script>alert("It\'s a trap!");</script>'
1) Escaped for insertion into HTML element context
>>> print cgi.escape(s) <script>alert("It's a trap!");</script>
2) Escaped for insertion into HTML element or attribute context
>>> print h.escape(s) <script>alert("It's a trap!");</script>
This is the default Mako escaping, as usually used by Kallithea.
3) Encoded as JSON
>>> print json.dumps(s) "<script>alert(\"It's a trap!\");</script>"
4) Escaped for insertion into a JavaScript file
>>> print '(' + json.dumps(s) + ')' ("<script>alert(\"It's a trap!\");</script>")
The parentheses are not actually required for strings, but may be needed to avoid syntax errors if the value is a number or dict (object).
5) Escaped for insertion into a HTML inline <script> element
>>> print h.js(s) ("\x3cscript\x3ealert(\"It's a trap!\");\x3c/script\x3e")
Here, we need to combine JS and HTML escaping, further complicated by the fact that "<script>" tag contents can either be parsed in XHTML mode (in which case '<', '>' and '&' must additionally be XML escaped) or HTML mode (in which case '</script>' must be escaped, but not using HTML escaping, which is not available in HTML "<script>" tags). Therefore, the XML special characters (which can only occur in string literals) are escaped using JavaScript string literal escape sequences.
(This, incidentally, is why modern web security best practices ban all use of inline JavaScript...)
Unsurprisingly, Kallithea does not do (5) correctly. In most cases, Kallithea might slap a pair of single quotes around the HTML escaped Python value. A typical benign example:
$('#child_link').html('${_('No revisions')}');
This works in English, but if a localized version of the string contains an apostrophe, the result will be broken JavaScript. In the more severe cases, where the text is user controllable, it leaves the door open to injections. In this example, the script inserts the string as HTML, so Mako's implicit HTML escaping makes sense; but in many other cases, HTML escaping is actually an error, because the value is not used by the script in an HTML context.
The good news is that the HTML escaping thwarts attempts at XSS, since it's impossible to inject syntactically valid JavaScript of any useful complexity. It does allow JavaScript errors and gibberish to appear on the page, though.
In these cases, the escaping has been fixed to use either the new 'h.js' helper, which does JavaScript escaping (but not HTML escaping), OR the new 'h.jshtml' helper (which does both), in those cases where it was unclear if the value might be used (by the script) in an HTML context. Some of these can probably be "relaxed" from h.jshtml to h.js later, but for now, using h.jshtml fixes escaping and doesn't introduce new errors.
In a few places, Kallithea JSON encodes values in the controller, then inserts the JSON (without any further escaping) into <script> tags. This is also wrong, and carries actual risk of XSS vulnerabilities. However, in all cases, security vulnerabilities were narrowly avoided due to other filtering in Kallithea. (E.g. many special characters are banned from appearing in usernames.) In these cases, the escaping has been fixed and moved to the template, making it immediately visible that proper escaping has been performed.
Mini-FAQ (frequently anticipated questions):
Q: Why do everything in one big, hard to review patch? Q: Why add escaping in specific case FOO, it doesn't seem needed?
Because the goal here is to have "escape everywhere" as the default policy, rather than identifying individual bugs and fixing them one by one by adding escaping where needed. As such, this patch surely introduces a lot of needless escaping. This is no different from how Mako/Pylons HTML escape everything by default, even when not needed: it's errs on the side of needless work, to prevent erring on the side of skipping required (and security critical) work.
As for reviewability, the most important thing to notice is not where escaping has been introduced, but any places where it might have been missed (or where h.jshtml is needed, but h.js is used).
Q: The added escaping is kinda verbose/ugly.
That is not a question, but yes, I agree. Hopefully it'll encourage us to move away from inline JavaScript altogether. That's a significantly larger job, though; with luck this patch will keep us safe and secure until such a time as we can implement the real fix.
Q: Why not use Mako filter syntax ("${val|h.js}")?
Because of long-standing Mako bug #140, preventing use of 'h' in filters.
Q: Why not work around bug #140, or even use straight "${val|js}"?
Because Mako still applies the default h.escape filter before the explicitly specified filters.
Q: Where do we go from here?
Longer term, we should stop doing variable expansions in script blocks, and instead pass data to JS via e.g. data attributes, or asynchronously using AJAX calls. Once we've done that, we can remove inline JavaScript altogether in favor of separate script files, and set a strict Content Security Policy explicitly blocking inline scripting, and thus also the most common kind of cross-site scripting attack.
|
|
|
Søren Løvborg
|
10f16cf8289e
|
9 years ago
|
|
cleanup: remove SQLAlchemy session argument to action_logger
There's always a global SQLAlchemy session associated with the current thread; using another session for a single function call does not make any sense (as sessions cannot be mixed), unless the code works carefully to ensure the two sessions (and all objects loaded from them) are kept completely separate. Suffice to say that Kallithea does no such thing, thus there's no need to pretend to support multiple concurrent sessions.
|
|
|
Søren Løvborg
|
b4d1e85265c1
|
9 years ago
|
|
auth: simplify repository group permission checks
In practice, Kallithea has the 'group.admin' permission imply the 'group.write' permission, which again implies 'group.read'.
This codifies this practice by replacing HasRepoGroupPermissionAny "perm function" with the new HasRepoGroupLevel function, reducing the risk of errors and saving quite a lot of typing.
|
|
|
Søren Løvborg
|
0a3e1a620edf
|
9 years ago
|
|
|
|
|
Mads Kiilerich
|
3dcf1f82311a
|
9 years ago
|
|
controllers: avoid setting request state in controller instances - set it in the thread global request variable
In TurboGears, controllers are singletons and we should avoid using instance variables for any volatile data. Instead, use the "global thread local" request context.
With everything in request, some use of c is dropped.
Note: kallithea/controllers/api/__init__.py still use instance variables that will cause problems with TurboGears.
|
|
|
Mads Kiilerich
|
acdd8d23e362
|
9 years ago
|
|
repo_groups: set c.active when displaying repo creation form errors through repo_group_edit.html
Writing failing tests revealed a crash.
|
|
|
Søren Løvborg
|
36e22160e5e5
|
9 years ago
|
|
db: rename RepoGroup.group_parent_id to parent_group_id
Also for consistency with the existing parent_group relationship.
|
|
|
Mads Kiilerich
|
a6af26b5ffc1
|
9 years ago
|
|
|
|
|
Søren Løvborg
|
cd6176c0634a
|
9 years ago
|
|
db: PullRequest/Repository/RepoGroup/UserGroup: change 'user' to 'owner'
Rename the 'user' and 'user_id' fields on the four classes to something more informative. The database column names remain unchanged for now; a later Alembic script can fix the name of these and other columns to match their Python name.
This might break rcextensions, though, and external scripts that use the HTML form interface.
|
|
|
Søren Løvborg
|
590d5b7a2b26
|
9 years ago
|
|
db: do case-insensitive explicit sorting of RepoGroup names
This does not change the implicit sorting enabled via __mapper_args__, which is a bad idea anyway (and now deprecated), and will have to be dealt with in a later changeset.
The use of __mapper_args__ implicitly adds sorting to every query of RepoGroup objects throughout the code (including implicit queries via relationships). For the relationships, __mapper_args can be replaced with "order_by" on each individual relationship, and it's reasonably straight-forward to identify every RepoGroup query throughout the code, and add explicit sorting. But we don't really need that sorting most of the time, so a better way forward may be to identify all the places that actually needs the sorting, make it explicit there, and then kill the __mapper_args__. (Anyway, future work.)
|
|
|
Søren Løvborg
|
0b7b8e8031e6
|
9 years ago
|
|
|
|
|
Søren Løvborg
|
873a3839865d
|
9 years ago
|
|
|
|
|
Thomas De Schampheleire
|
af3539a458f6
|
9 years ago
|
|
Turbogears2 migration: replace pylons.url by kallithea.config.routing.url
In preparation for the migration to Turbogears2, introduce a kallithea.config.routing.url to replace pylons.url. The implementation is basically the same: wrap around routes.url().
This change involves: - a number of import statement changes - fixing some tests in test_libs.py; to avoid duplication, the different implementations of fake_url were grouped in one place.
This change was first proposed by Alessandro Molina in his initial port. Following changes were made afterwards: - move UrlGenerator from kallithea.lib.utils to kallithea.config.routing - add documentation to UrlGenerator - kallithea/lib/auth.py used url_for instead of url, for no apparent reason so this was changed. - fix libs tests - rebase onto Pylons-based Kallithea first
|
|
|
Mads Kiilerich
|
c0a3519e7d2c
|
9 years ago
|
|
controllers: remove pointless comments
These comments are mostly trivial and sometimes wrong. We don't want to maintain or pretend we do.
|
|
|
Søren Løvborg
|
09bcde0eee6d
|
9 years ago
|
|
auth: remove HasPermissionAll and variants
First, find all calls to HasPermissionAll with only a single permission given, and convert to equivalent calls to HasPermissionAny.
Next, observe that it's hard to envision situations requiring multiple permissions (of the same scope: global/repo/repo group) to be satisfied. Sufficiently hard that there are actually no such examples in the code.
Finally, considering that (should it ever be needed) HasPermissionAll can be trivially built as a conjunction of HasPermissionAny calls (the decorators, too) with only a small performance impact, simply remove HasPermissionAll and related classes and functions.
|
|
|
Mads Kiilerich
|
73e44865f204
|
9 years ago
|
|
|
|
|
Mads Kiilerich
|
edb24bc0f71a
|
10 years ago
|
|
|
|
|
Søren Løvborg
|
d9b78d8f1db3
|
10 years ago
|
|
cleanup: replace redirect with WebOb exceptions
All redirect does is to log "Generating 302 redirect" with logging the actual location and raise a WebOb HTTPFound exception, and the logging is redundant, as WebOb exceptions and their status codes are already logged.
Instead, just raise the exception directly, which is both explicit and simpler (and finally, gets rid of "return redirect" which never really returns).
|
|
|
Søren Løvborg
|
1fc8d7e9f3ab
|
10 years ago
|
|
cleanup: replace abort with WebOb exceptions
All abort does is to look up the matching WebOb exception and raising that; so just raise it directly. WebOb exception names are also more readable than HTTP error codes. (And finally, don't "return abort", since abort never returns.)
|
|
|
Søren Løvborg
|
b361974171ea
|
10 years ago
|
|
spelling: fix inappropriate use of title case
These are not titles or labels, and should not be title cased.
|
|
|
Mads Kiilerich
|
7d0727d11104
|
10 years ago
|
|
cleanup: remove unused imports
Found with pyflakes.
|
|
|
Mads Kiilerich
|
d69aa464f373
|
10 years ago
|
|
cleanup: consistently use 'except ... as ...:'
Use the Python 2.6+ syntax instead of the old confusing 'except ..., ...' syntax.
|
|
|
Mads Kiilerich
|
cd655fbd79ce
|
10 years ago
|
|
|
|
|
Mads Kiilerich
|
6245435fd8d7
|
10 years ago
|
|
|
|
|
Mads Kiilerich
|
2f794e9061f5
|
10 years ago
|
|
|
|
|
Mads Kiilerich
|
82faecc21324
|
10 years ago
|
|
|
|
|
Mads Kiilerich
|
f43dc1913984
|
10 years ago
|
|
|
|
|
Nick High
|
a8f2986afc18
|
11 years ago
|
|
security: Fix HTML and JavaScript injection.
This fixes CVE-2015-1864
|
|
|
Mads Kiilerich
|
c04c2734e32f
|
11 years ago
|
|
controllers: consistently use formfill.render with force_defaults=False
The inconsistency could cause confusion for developers. It seems to me like force_defaults=False should be the default ... and apparently it was that in older versions of formfill.
It could perhaps make sense for us to have a wrapper that added the defualt values once, instead of repeating it all over ;-)
|
|
|
Thomas De Schampheleire
|
923037eb67d4
|
11 years ago
|
|
spelling: fix various typos
This commit fixes various typos or basic English grammar mistakes found by reviewing the kallithea.pot file.
Full correction of sentences that are not very well formulated, like missing articles, is out of scope for this commit. Likewise for inconsistent capitalization of strings like 'Repository group'/'Repository Group'.
|
|
|
Mads Kiilerich
|
716194520cc0
|
11 years ago
|
|
user: use h.person(obj.user) instead of h.person(obj.user.username) - don't fail if user is None
h.person prefer a user object anyway - just pass it obj.user and make sure h.person doesn't crash on getting a None user.
|
|
|
Mads Kiilerich
|
395be5fa6eef
|
11 years ago
|
|
|
|
|
Mads Kiilerich
|
d51a6f5e57d1
|
11 years ago
|
|
|
|
|
Mads Kiilerich
|
ee43e19c18b7
|
12 years ago
|
|
|
|
|
Bradley M. Kuhn
|
24c0d584ba86
|
11 years ago
|
|
|
|
|
Bradley M. Kuhn
|
1948ede028ef
|
11 years ago
|
|
|
|
|
Bradley M. Kuhn
|
ad38f9f93b3b
|
11 years ago
|
|
Correct licensing information in individual files.
The top-level license file is now LICENSE.md.
Also, in various places where there should have been joint copyright holders listed, a single copyright holder was listed. It does not appear easy to add a link to a large list of copyright holders in these places, so it simply refers to the fact that various authors hold copyright.
In future, if an easy method is discovered to link to a list from those places, we should do so.
Finally, text is added to LICENSE.md to point to where the full list of copyright holders is, and that Kallithea as a whole is GPLv3'd.
|
|
|
Bradley M. Kuhn
|
d208416c84c6
|
11 years ago
|
|
|
|
|
Bradley M. Kuhn
|
d1addaf7a91e
|
11 years ago
|
|
Second step in two-part process to rename directories. This is the actual directory rename.
|