October 2014 - tor-commits - lists.torproject.org

[pups/production] using <a> instead of <span> for links
by colin＠torproject.org 24 Oct '14

24 Oct '14

commit bcf5711885f59502fa6627cf0cbfd05826a60344 Author: Sherief Alaa <sheriefalaa.w(a)gmail.com> Date: Sat Jun 21 22:38:46 2014 +0300 using <a> instead of <span> for links --- webchat/templates/tokens.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/webchat/templates/tokens.html b/webchat/templates/tokens.html index 20c3de1..22f16ad 100644 --- a/webchat/templates/tokens.html +++ b/webchat/templates/tokens.html @@ -51,7 +51,7 @@ {{token.comment|slice:":35"}} {% if token.comment|length > 35 %} - <span data-toggle="modal" data-target="#comment-modal" style="color:blue; font-size:80%;"> more</span> + <a data-toggle="modal" data-target="#comment-modal" style="color:blue; font-size:80%;" href=""> more</a> {% endif %} </td> </tr>

1 0

[pups/production] Using @staticmethod instead of instantiating Token() objects
by colin＠torproject.org 24 Oct '14

24 Oct '14

commit ca32dabf87eb018af2886fe35cd6dfe561c12e70 Author: Sherief Alaa <sheriefalaa.w(a)gmail.com> Date: Sun Jun 22 00:43:25 2014 +0300 Using @staticmethod instead of instantiating Token() objects --- webchat/models.py | 10 +++++++--- webchat/views.py | 9 +++------ 2 files changed, 10 insertions(+), 9 deletions(-) diff --git a/webchat/models.py b/webchat/models.py index 375ba04..6722aa1 100644 --- a/webchat/models.py +++ b/webchat/models.py @@ -41,7 +41,8 @@ class Token(models.Model): def __unicode__(self): return u'ID: %s Owner: %s visits: %s' % (self.t_id, self.owner, self.visits) - def create_token(self, owner_id, expiration_days, comment): + @staticmethod + def create_token(owner_id, expiration_days, comment): q = Token( owner=User.objects.get(id=owner_id), token=uuid.uuid4().hex, @@ -52,13 +53,15 @@ class Token(models.Model): return q.t_id is not None + @staticmethod def get_token(self, token): try: return Token.objects.get(token=token) except ObjectDoesNotExist: return [] - def revoke_tokens(self, token_list): + @staticmethod + def revoke_tokens(token_list): ''' Sets the expiration date equals to the creation date of a token or more ''' @@ -68,7 +71,8 @@ class Token(models.Model): .update(expires_at=F('created_at')) return True - def get_assistant_tokens(self, assistant): + @staticmethod + def get_assistant_tokens(assistant): ''' Returns a list of non-expired/revoked assistant's tokens ''' diff --git a/webchat/views.py b/webchat/views.py index f5b9aad..166e9be 100644 --- a/webchat/views.py +++ b/webchat/views.py @@ -32,7 +32,6 @@ from pups import settings @login_required def tokens_page(request): - token = Token() # Create one token if 'create_token' in request.POST: @@ -44,7 +43,7 @@ def tokens_page(request): params = { 'name': request.user.username, - 'tokens': token.get_assistant_tokens( + 'tokens': Token.get_assistant_tokens( User.objects.get(id=request.user.id)), 'url': settings.CONFIG['url'] } @@ -53,9 +52,8 @@ def tokens_page(request): def create_token(request): - token = Token() - if not token.create_token(request.user.id, + if not Token.create_token(request.user.id, settings.CONFIG['expiration_days'], request.POST.get('comment', '')): @@ -67,7 +65,6 @@ def create_token(request): def revoke_tokens(request): - token = Token() # If nothing was selected redirect and complain if len(request.POST.getlist("selected_list")) == 0: @@ -75,7 +72,7 @@ def revoke_tokens(request): return redirect('/tokens') # Revoke a token or more - token.revoke_tokens(request.POST.getlist("selected_list")) + Token.revoke_tokens(request.POST.getlist("selected_list")) messages.add_message(request, messages.INFO, fbm.revoke_success) return redirect('/tokens')

1 0

[pups/production] Merge remote-tracking branch 'sherief/webchat_patches'
by colin＠torproject.org 24 Oct '14

24 Oct '14

commit 9d1cdab390c3839b8bdf3cc7717ed51ed8095ffb Merge: 57a54ad fad8d3f Author: Lunar <lunar@loar> Date: Sat Oct 11 11:48:13 2014 +0200 Merge remote-tracking branch 'sherief/webchat_patches' pups/settings.py.sample | 1 + static/css/styles.css | 1 + static/js/prodromus.js | 47 ++++++++++++++++++-------------------- webchat/models.py | 27 ++++++++++++++-------- webchat/templates/prodromus.html | 4 +++- webchat/templates/tokens.html | 17 +++++++------- webchat/views.py | 26 +++++++++++---------- 7 files changed, 66 insertions(+), 57 deletions(-)

1 0

[pups/production] removed Token.get_token()
by colin＠torproject.org 24 Oct '14

24 Oct '14

commit 3ef9187c2792162883e472fbd15f2c8f7644fe56 Author: Sherief Alaa <sheriefalaa.w(a)gmail.com> Date: Sun Jun 22 00:52:50 2014 +0300 removed Token.get_token() --- webchat/models.py | 7 ------- 1 file changed, 7 deletions(-) diff --git a/webchat/models.py b/webchat/models.py index 6722aa1..8d25021 100644 --- a/webchat/models.py +++ b/webchat/models.py @@ -54,13 +54,6 @@ class Token(models.Model): return q.t_id is not None @staticmethod - def get_token(self, token): - try: - return Token.objects.get(token=token) - except ObjectDoesNotExist: - return [] - - @staticmethod def revoke_tokens(token_list): ''' Sets the expiration date equals to the creation date of a token or more

1 0

[pups/production] [#12626] Fixes multi-line support in webchat
by colin＠torproject.org 24 Oct '14

24 Oct '14

commit fad8d3fedd274018fb6b9bad41c411bed550d34f Author: Sherief <sheriefalaa.w(a)gmail.com> Date: Mon Oct 6 01:46:31 2014 +0200 [#12626] Fixes multi-line support in webchat --- static/css/styles.css | 1 + static/js/prodromus.js | 6 +----- 2 files changed, 2 insertions(+), 5 deletions(-) diff --git a/static/css/styles.css b/static/css/styles.css index cebaba8..d4467eb 100644 --- a/static/css/styles.css +++ b/static/css/styles.css @@ -122,6 +122,7 @@ div#prodromus div#prodromus-log div.message span.msgText { font-weight: bold; background: #E0E1E1 url(../images/prodromus_bubble_content.png) left top no-repeat; padding: 0px 12px; + word-wrap: break-word; } div#prodromus div#prodromus-log div.message span.msgPerson { diff --git a/static/js/prodromus.js b/static/js/prodromus.js index 29b2331..4652ed1 100644 --- a/static/js/prodromus.js +++ b/static/js/prodromus.js @@ -175,10 +175,6 @@ Prodromus.actionhandler = { }, sendmessage: function() { - $('#prodromus-message').val( - $('#prodromus-message').val().replace(/\n/g,"").replace(/\r/g,"") - ); - if( $('#prodromus-message').val() != '' ) { Prodromus.buildAndSendMessage( $('#prodromus-message').val(), 'chat' ); $('#prodromus-message').val(''); @@ -546,4 +542,4 @@ function getStatus(status) if (connfail !== true) Prodromus.PresenceReporter.giveFeedback(); } -} \ No newline at end of file +}

1 0

[pups/production] [#12625] Stops prodromus from eating http/https links
by colin＠torproject.org 24 Oct '14

24 Oct '14

commit dff26ee81d74a11a40a39d7b57e942e2f9fdebb5 Author: Sherief <sheriefalaa.w(a)gmail.com> Date: Thu Oct 2 01:07:59 2014 +0200 [#12625] Stops prodromus from eating http/https links The webchat UI previously ate http/https from links as a form of simplifying/beautifying urls but that proved bad when users copy/pasted logs so now it displays full links instead of simpler ones. --- static/js/prodromus.js | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/static/js/prodromus.js b/static/js/prodromus.js index 7dbe826..29b2331 100644 --- a/static/js/prodromus.js +++ b/static/js/prodromus.js @@ -105,13 +105,7 @@ Prodromus.Util = { text = text.replace( /((https?\:\/\/|ftp\:\/\/)|(www\.))(\S+)(\w{2,4})(:[0-9]+)?(\/|\/([\w#!:.?+=&%@!\-\/]))?/gi , function( url ) { - nice = url; - if( url.match( "^https?:\/\/" ) ) { - nice = nice.replace( /^https?:\/\//i, "" ) - } else { - url = 'http://'+url; - } - return '<a target="_blank" href="' + url + '">' + nice.replace( /^www./i, "" ) + '</a>'; + return '<a target="_blank" href="' + url + '">' + url + '</a>'; } );

1 0

[tor/release-0.2.5] declare 0.2.3.x end-of-life more clearly
by arma＠torproject.org 24 Oct '14

24 Oct '14

commit 42b42605f8d8eac25361be229354f6393967df4f Author: Roger Dingledine <arma(a)torproject.org> Date: Thu Oct 23 22:05:54 2014 -0400 declare 0.2.3.x end-of-life more clearly --- ChangeLog | 33 +++++++++++++++---------------- ReleaseNotes | 61 +++++++++++++++++++++++++--------------------------------- 2 files changed, 42 insertions(+), 52 deletions(-) diff --git a/ChangeLog b/ChangeLog index 749abf8..3daba3e 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,25 +1,24 @@ Changes in version 0.2.5.10 - 2014-10-24 Tor 0.2.5.10 is the first stable release in the 0.2.5 series. - It adds several new security features, including improved DoS - resistance for relays, new compiler hardening options, and a - system-call sandbox for hardened installations on Linux (requires - seccomp2). The controller protocol has several new features, resolving - IPv6 addresses should work better than before, and relays should be a - little more CPU-efficient. We've added support for more (Open,Free)BSD - transparent proxy types. We've improved the build system and testing - intrastructure to allow unit testing of more parts of the Tor - codebase. Finally, we've addressed several nagging pluggable transport - usability issues, and included numerous other small bugfixes and - features mentioned below. - - This release coincides with the likely end of further 0.2.3.x - releases; see below for more information. + It adds several new security features, including improved + denial-of-service resistance for relays, new compiler hardening + options, and a system-call sandbox for hardened installations on Linux + (requires seccomp2). The controller protocol has several new features, + resolving IPv6 addresses should work better than before, and relays + should be a little more CPU-efficient. We've added support for more + OpenBSD and FreeBSD transparent proxy types. We've improved the build + system and testing infrastructure to allow unit testing of more parts + of the Tor codebase. Finally, we've addressed several nagging pluggable + transport usability issues, and included numerous other small bugfixes + and features mentioned below. + + This release marks end-of-life for Tor 0.2.3.x; those Tor versions + have accumulated many known flaws; everyone should upgrade. o Deprecated versions: - - Tor 0.2.3.x is approaching its end-of-life too; we do not plan on - releasing further updates for it except under highly unusual - circumstances. + - Tor 0.2.3.x has reached end-of-life; it has received no patches or + attention for some while. Changes in version 0.2.5.9-rc - 2014-10-20 diff --git a/ReleaseNotes b/ReleaseNotes index cf7c145..337470b 100644 --- a/ReleaseNotes +++ b/ReleaseNotes @@ -5,43 +5,32 @@ each development snapshot, see the ChangeLog file. Changes in version 0.2.5.10 - 2014-10-24 Tor 0.2.5.10 is the first stable release in the 0.2.5 series. - It adds several new security features, including improved DoS - resistance for relays, new compiler hardening options, and a - system-call sandbox for hardened installations on Linux (requires - seccomp2). The controller protocol has several new features, resolving - IPv6 addresses should work better than before, and relays should be a - little more CPU-efficient. We've added support for more (Open,Free)BSD - transparent proxy types. We've improved the build system and testing - intrastructure to allow unit testing of more parts of the Tor - codebase. Finally, we've addressed several nagging pluggable transport - usability issues, and included numerous other small bugfixes and - features mentioned below. - - This release coincides with the likely end of further 0.2.3.x - releases; see below for more information. - - o Deprecated versions: - - Tor 0.2.2.x has reached end-of-life; it has received no patches or - attention for some while. Directory authorities no longer accept - descriptors from relays running any version of Tor prior to Tor - 0.2.3.16-alpha. Resolves ticket 11149. - - Tor 0.2.3.x is approaching its end-of-life too; we do not plan on - releasing further updates for it except under highly unusual - circumstances. - - o Major features (client security): + It adds several new security features, including improved + denial-of-service resistance for relays, new compiler hardening + options, and a system-call sandbox for hardened installations on Linux + (requires seccomp2). The controller protocol has several new features, + resolving IPv6 addresses should work better than before, and relays + should be a little more CPU-efficient. We've added support for more + OpenBSD and FreeBSD transparent proxy types. We've improved the build + system and testing infrastructure to allow unit testing of more parts + of the Tor codebase. Finally, we've addressed several nagging pluggable + transport usability issues, and included numerous other small bugfixes + and features mentioned below. + + This release marks end-of-life for Tor 0.2.3.x; those Tor versions + have accumulated many known flaws; everyone should upgrade. + + o Major features (security): - The ntor handshake is now on-by-default, no matter what the directory authorities recommend. Implements ticket 8561. - - o Major features (other security): - - Disable support for SSLv3. All versions of OpenSSL in use with Tor - today support TLS 1.0 or later, so we can safely turn off support - for this old (and insecure) protocol. Fixes bug 13426. - - Warn about attempts to run hidden services and relays in the same - process: that's probably not a good idea. Closes ticket 12908. - Make the "tor-gencert" tool used by directory authority operators create 2048-bit signing keys by default (rather than 1024-bit, since 1024-bit is uncomfortably small these days). Addresses ticket 10324. + - Warn about attempts to run hidden services and relays in the same + process: that's probably not a good idea. Closes ticket 12908. + - Disable support for SSLv3. All versions of OpenSSL in use with Tor + today support TLS 1.0 or later, so we can safely turn off support + for this old (and insecure) protocol. Fixes bug 13426. o Major features (relay security, DoS-resistance): - When deciding whether we have run out of memory and we need to @@ -74,8 +63,6 @@ Changes in version 0.2.5.10 - 2014-10-24 even when pluggable transports are in use, and report usage statistics in their extra-info descriptors. Resolves tickets 4773 and 5040. - - o Major features (bridges): - Don't launch pluggable transport proxies if we don't have any bridges configured that would use them. Now we can list many pluggable transports, and Tor will dynamically start one when it @@ -132,6 +119,10 @@ Changes in version 0.2.5.10 - 2014-10-24 are dumped to stderr (if possible) and to any logs that are reporting errors. Implements ticket 9299. + o Deprecated versions: + - Tor 0.2.3.x has reached end-of-life; it has received no patches or + attention for some while. + o Major bugfixes (security, directory authorities): - Directory authorities now include a digest of each relay's identity key as a part of its microdescriptor. @@ -544,7 +535,7 @@ Changes in version 0.2.5.10 - 2014-10-24 write out that file if we successfully switch to the new config option. Fixes bug 5605; bugfix on 0.2.2.26-beta. Patch from "Ryman". - o Minor bugfixes (Directory server): + o Minor bugfixes (directory server): - No longer accept malformed http headers when parsing urls from headers. Now we reply with Bad Request ("400"). Fixes bug 2767; bugfix on 0.0.6pre1.

1 0

[webwml/master] switch to some new keys for jake
by arma＠torproject.org 24 Oct '14

24 Oct '14

commit 6a51711b01f2c20595c1247d1c1d4c2d2abcf49e Author: Roger Dingledine <arma(a)torproject.org> Date: Thu Oct 23 22:04:33 2014 -0400 switch to some new keys for jake --- docs/en/signing-keys.wml | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) diff --git a/docs/en/signing-keys.wml b/docs/en/signing-keys.wml index 5b30e42..d114f61 100644 --- a/docs/en/signing-keys.wml +++ b/docs/en/signing-keys.wml @@ -31,7 +31,7 @@ <li>The Tails team (0xBE2CD9C1) signs the Tails live system releases.</li> <li>Other developers include Peter Palfrader (0xC82E0039, or its - subkey 0xE1DEC577) and Jacob Appelbaum (0xE012B42D).</li> + subkey 0xE1DEC577) and Jacob Appelbaum (0xD255D3F5C868227F).</li> </ul> The fingerprints for the keys should be: @@ -123,7 +123,7 @@ pub 4096R/C5AA446D 2010-07-14 Key fingerprint = 261C 5FBE 7728 5F88 FB0C 3432 66C8 C2D7 C5AA 446D - uid Sebastian Hahn <mail(a)sebastianhahn.net> + uid Sebastian Hahn <mail(a)sebastianhahn.net> sub 2048R/A2499719 2010-07-14 sub 2048R/140C961B 2010-07-14 @@ -166,6 +166,24 @@ Key fingerprint = 4A90 646C 0BAE D9D4 56AB 3111 E5B8 1856 D022 0E4B uid Nicolas Vigier (TBB Builds Signing Key) <boklm(a)torproject.org> + pub 4096R/D255D3F5C868227F 2014-06-27 [expires: 2024-06-24] + Key fingerprint = D2C6 7D20 E9C3 6C2A C5FE 74A2 D255 D3F5 C868 227F + uid Jacob Appelbaum <jacob(a)appelbaum.net> + sub 3072R/02636620744301A2 2014-06-27 [expires: 2015-06-27] + sub 3072R/1A055A481801A819 2014-06-27 [expires: 2015-06-27] + + pub 4096R/90BC9192B06291B2 2014-06-27 [expires: 2024-06-24] + Key fingerprint = 043E 0E69 DD56 BA59 5905 8756 90BC 9192 B062 91B2 + uid Jacob Appelbaum <error(a)debian.org> + sub 3072R/F78ED60FFE4F141F 2014-06-27 [expires: 2015-06-27] + sub 3072R/986D6BCEF02A9C9C 2014-06-27 [expires: 2015-06-27] + sub 2048R/89AA6E5D2C6A7F40 2014-10-22 [expires: 2016-10-21] + + pub 4096R/FA7F0E44D487F03F 2014-06-27 [expires: 2024-06-24] + Key fingerprint = D6A9 48CF 297F 7539 30B4 756A FA7F 0E44 D487 F03F + uid Jacob Appelbaum <jacob(a)torproject.org> + sub 3072R/611B45DE2517F1BA 2014-06-27 [expires: 2015-06-27] + sub 3072R/035D7A9A67D22BC0 2014-06-27 [expires: 2015-06-27] </pre> </div>

1 0

[tor-browser/tor-browser-31.2.0esr-4.x-1] Bug 13301: Avoid incompatible extensions prompt.
by mikeperry＠torproject.org 24 Oct '14

24 Oct '14

commit bc7f0127a2832ea6c9d7e72269404d9034793a92 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Tue Oct 14 15:10:49 2014 -0400 Bug 13301: Avoid incompatible extensions prompt. When updating via the background / timer-based check, the updater reported to the user that some extensions were incompatible (not true). The fix is to check extension compatibility against the platformVersion in a few more places (instead of against the appVersion, which is something like "4.0-alpha-3"). --- toolkit/mozapps/update/content/updates.js | 35 +++++++++++++++++++++++++---- toolkit/mozapps/update/jar.mn | 2 +- 2 files changed, 32 insertions(+), 5 deletions(-) diff --git a/toolkit/mozapps/update/content/updates.js b/toolkit/mozapps/update/content/updates.js index 7cebf0f..00cf228 100644 --- a/toolkit/mozapps/update/content/updates.js +++ b/toolkit/mozapps/update/content/updates.js @@ -1,3 +1,5 @@ +#filter substitution + /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ /* This Source Code Form is subject to the terms of the Mozilla Public * License, v. 2.0. If a copy of the MPL was not distributed with this @@ -49,6 +51,11 @@ const CERT_ATTR_CHECK_FAILED_NO_UPDATE = 100; const CERT_ATTR_CHECK_FAILED_HAS_UPDATE = 101; const BACKGROUNDCHECK_MULTIPLE_FAILURES = 110; +#ifdef TOR_BROWSER_VERSION +# Add double-quotes back on (stripped by JarMaker.py). +#expand const TOR_BROWSER_VERSION = "__TOR_BROWSER_VERSION__"; +#endif + var gLogEnabled = false; var gUpdatesFoundPageId; @@ -531,8 +538,13 @@ var gUpdates = { return; } +#ifdef TOR_BROWSER_UPDATE + var appVersion = TOR_BROWSER_VERSION; +#else + var appVersion = Services.appinfo.version; +#endif if (!this.update.appVersion || - Services.vc.compare(this.update.appVersion, Services.appinfo.version) == 0) { + Services.vc.compare(this.update.appVersion, appVersion) == 0) { aCallback(false); return; } @@ -544,6 +556,11 @@ var gUpdates = { var self = this; AddonManager.getAllAddons(function(addons) { +#ifdef TOR_BROWSER_UPDATE + let compatVersion = self.update.platformVersion; +#else + let compatVersion = self.update.appVersion; +#endif self.addons = []; addons.forEach(function(addon) { // Protect against code that overrides the add-ons manager and doesn't @@ -572,7 +589,7 @@ var gUpdates = { !addon.appDisabled && !addon.userDisabled && addon.scope != AddonManager.SCOPE_APPLICATION && addon.isCompatible && - !addon.isCompatibleWith(self.update.appVersion, + !addon.isCompatibleWith(compatVersion, self.update.platformVersion)) self.addons.push(addon); } @@ -842,9 +859,14 @@ var gIncompatibleCheckPage = { this._totalCount = gUpdates.addons.length; this._pBar.mode = "normal"; +#ifdef TOR_BROWSER_UPDATE + let compatVersion = gUpdates.update.platformVersion; +#else + let compatVersion = gUpdates.update.appVersion; +#endif gUpdates.addons.forEach(function(addon) { addon.findUpdates(this, AddonManager.UPDATE_WHEN_NEW_APP_DETECTED, - gUpdates.update.appVersion, + compatVersion, gUpdates.update.platformVersion); }, this); }, @@ -869,8 +891,13 @@ var gIncompatibleCheckPage = { // the add-on will become incompatible. let bs = CoC["@mozilla.org/extensions/blocklist;1"]. getService(CoI.nsIBlocklistService); +#ifdef TOR_BROWSER_UPDATE + let compatVersion = gUpdates.update.platformVersion; +#else + let compatVersion = gUpdates.update.appVersion; +#endif if (bs.isAddonBlocklisted(addon, - gUpdates.update.appVersion, + compatVersion, gUpdates.update.platformVersion)) return; diff --git a/toolkit/mozapps/update/jar.mn b/toolkit/mozapps/update/jar.mn index 9bb5d2d..5347123 100644 --- a/toolkit/mozapps/update/jar.mn +++ b/toolkit/mozapps/update/jar.mn @@ -7,6 +7,6 @@ toolkit.jar: content/mozapps/update/history.xul (content/history.xul) content/mozapps/update/history.js (content/history.js) content/mozapps/update/updates.css (content/updates.css) - content/mozapps/update/updates.js (content/updates.js) +* content/mozapps/update/updates.js (content/updates.js) content/mozapps/update/updates.xml (content/updates.xml) content/mozapps/update/updates.xul (content/updates.xul)

1 0

[tor-browser/tor-browser-31.2.0esr-4.x-1] Merge remote-tracking branch 'brade/bug13301' into tor-browser-31.2.0esr-4.x-1
by mikeperry＠torproject.org 24 Oct '14

24 Oct '14

commit 1c33659d907bcfdb9f6f06383942b1f57c3abcfe Merge: 6cb68a4 bc7f012 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Thu Oct 23 18:19:53 2014 -0700 Merge remote-tracking branch 'brade/bug13301' into tor-browser-31.2.0esr-4.x-1 toolkit/mozapps/update/content/updates.js | 35 +++++++++++++++++++++++++---- toolkit/mozapps/update/jar.mn | 2 +- 2 files changed, 32 insertions(+), 5 deletions(-)

1 0