Many hyperlinks are disabled.
Use anonymous login
to enable hyperlinks.
Changes In Branch sec2020-config-protection Excluding Merge-Ins
This is equivalent to a diff from fb41384045 to aa4c3afc52
2020-08-19
| ||
01:07 | Cherrypick key fixes from the sec2020 branch in order to devise a minimal patch to get us to version 2.12.1. ... (check-in: fe1264d35d user: drh tags: sec2020-2.12-patch) | |
2020-08-17
| ||
20:03 | Identify security-sensitive settings. ... (check-in: 3bccd7fff2 user: drh tags: sec2020) | |
17:34 | The allow-symlinks setting is no longer versionable and is off by default. The allow-symlinks setting no longer propagates with a clone. The help text for allow-symlinks discourages its use. There is a new --symlink flag on "fossil open" to permit the use of symlinks on an open, for the adventurous. Ticket [f9831fdef1d4edcc]. ... (check-in: ff98dd5af6 user: drh tags: sec2020) | |
15:11 | Identify security-sensitive settings. ... (Closed-Leaf check-in: aa4c3afc52 user: drh tags: sec2020-config-protection) | |
14:09 | Set an authorizer when running the ticket-table SQL. Ticket [56b82836ffba9952]. ... (check-in: fb41384045 user: drh tags: sec2020) | |
09:16 | Prohibit redirects from HTTP or HTTPS over to SSH or FILE. Fix for ticket [61613b0a9cf843b6]. ... (check-in: 253dbd15e2 user: drh tags: sec2020) | |
Changes to src/alerts.c.
︙ | |||
934 935 936 937 938 939 940 | 934 935 936 937 938 939 940 941 942 943 944 945 946 947 948 949 950 951 952 953 954 955 956 957 958 959 960 961 962 963 964 965 966 967 968 969 970 971 972 973 974 975 976 977 978 979 980 981 982 983 | - + - + - + - + - + | /* ** SETTING: email-subname width=16 ** This is a short name used to identifies the repository in the Subject: ** line of email alerts. Traditionally this name is included in square ** brackets. Examples: "[fossil-src]", "[sqlite-src]". */ /* |
︙ |
Changes to src/db.c.
︙ | |||
3430 3431 3432 3433 3434 3435 3436 | 3430 3431 3432 3433 3434 3435 3436 3437 3438 3439 3440 3441 3442 3443 3444 3445 3446 3447 3448 3449 3450 3451 3452 | - - + - - - - - - - - - - - - | */ /* ** SETTING: admin-log boolean default=off ** ** When the admin-log setting is enabled, configuration changes are recorded ** in the "admin_log" table of the repository. */ |
︙ | |||
3505 3506 3507 3508 3509 3510 3511 | 3492 3493 3494 3495 3496 3497 3498 3499 3500 3501 3502 3503 3504 3505 3506 | - + | ** Backoffice processing does things such as delivering ** email notifications. So if this setting is true, and if ** there is no cron job periodically running "fossil backoffice", ** email notifications and other work normally done by the ** backoffice will not occur. */ /* |
︙ | |||
3582 3583 3584 3585 3586 3587 3588 | 3569 3570 3571 3572 3573 3574 3575 3576 3577 3578 3579 3580 3581 3582 3583 3584 3585 3586 3587 3588 3589 3590 3591 3592 3593 3594 3595 3596 3597 3598 3599 3600 3601 3602 3603 3604 3605 3606 3607 3608 3609 3610 | - + - + - + | ** The crnl-glob setting is a compatibility alias. */ /* ** SETTING: crnl-glob width=40 versionable block-text ** This is an alias for the crlf-glob setting. */ /* |
︙ | |||
3652 3653 3654 3655 3656 3657 3658 | 3639 3640 3641 3642 3643 3644 3645 3646 3647 3648 3649 3650 3651 3652 3653 3654 3655 3656 3657 3658 | - + - + | ** A comma- or newline-separated list of globs of filenames ** which are allowed to be edited using the /fileedit page. ** An empty list prohibits editing via that page. Note that ** it cannot edit binary files, so the list should not ** contain any globs for, e.g., images or PDFs. */ /* |
︙ | |||
3792 3793 3794 3795 3796 3797 3798 | 3779 3780 3781 3782 3783 3784 3785 3786 3787 3788 3789 3790 3791 3792 3793 | - + | ** SETTING: mv-rm-files boolean default=off ** If enabled, the "mv" and "rename" commands will also move ** the associated files within the checkout -AND- the "rm" ** and "delete" commands will also remove the associated ** files from within the checkout. */ /* |
︙ | |||
3852 3853 3854 3855 3856 3857 3858 | 3839 3840 3841 3842 3843 3844 3845 3846 3847 3848 3849 3850 3851 3852 3853 3854 3855 3856 3857 3858 3859 3860 3861 3862 3863 3864 3865 3866 3867 3868 3869 3870 3871 3872 3873 3874 3875 3876 3877 3878 3879 3880 3881 3882 3883 3884 3885 3886 3887 3888 3889 3890 3891 3892 3893 3894 3895 3896 3897 3898 3899 3900 3901 3902 3903 3904 3905 3906 3907 3908 3909 3910 3911 | - + - + - + - + - + - + - + - + | ** have a non-zero "repolist-skin" setting then the repository list is ** displayed using unadorned HTML ("skinless"). ** ** If repolist-skin has a value of 2, then the repository is omitted from ** the list in use cases 1 through 4, but not for 5 and 6. */ /* |
︙ | |||
3967 3968 3969 3970 3971 3972 3973 | 3954 3955 3956 3957 3958 3959 3960 3961 3962 3963 3964 3965 3966 3967 3968 | - + | ** SETTING: uv-sync boolean default=off ** If true, automatically send unversioned files as part ** of a "fossil clone" or "fossil sync" command. The ** default is false, in which case the -u option is ** needed to clone or sync unversioned files. */ /* |
︙ |
Changes to src/mkindex.c.
︙ | |||
88 89 90 91 92 93 94 95 96 97 98 99 100 101 | 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 | + | #define CMDFLAG_WEBPAGE 0x0008 /* Web pages */ #define CMDFLAG_COMMAND 0x0010 /* A command */ #define CMDFLAG_SETTING 0x0020 /* A setting */ #define CMDFLAG_VERSIONABLE 0x0040 /* A versionable setting */ #define CMDFLAG_BLOCKTEXT 0x0080 /* Multi-line text setting */ #define CMDFLAG_BOOLEAN 0x0100 /* A boolean setting */ #define CMDFLAG_RAWCONTENT 0x0200 /* Do not interpret webpage content */ #define CMDFLAG_SENSITIVE 0x0400 /* Security-sensitive setting */ /**************************************************************************/ /* ** Each entry looks like this: */ typedef struct Entry { int eType; /* CMDFLAG_* values */ |
︙ | |||
246 247 248 249 250 251 252 253 254 255 256 257 258 259 | 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 | + + | aEntry[nUsed].iWidth = 0; aEntry[nUsed].eType |= CMDFLAG_BOOLEAN; }else if( j==10 && strncmp(&zLine[i], "block-text", j)==0 ){ aEntry[nUsed].eType &= ~(CMDFLAG_BOOLEAN); aEntry[nUsed].eType |= CMDFLAG_BLOCKTEXT; }else if( j==11 && strncmp(&zLine[i], "versionable", j)==0 ){ aEntry[nUsed].eType |= CMDFLAG_VERSIONABLE; }else if( j==9 && strncmp(&zLine[i], "sensitive", j)==0 ){ aEntry[nUsed].eType |= CMDFLAG_SENSITIVE; }else if( j>6 && strncmp(&zLine[i], "width=", 6)==0 ){ aEntry[nUsed].iWidth = atoi(&zLine[i+6]); }else if( j>8 && strncmp(&zLine[i], "default=", 8)==0 ){ aEntry[nUsed].zDflt = string_dup(&zLine[i+8], j-8); }else if( j>9 && strncmp(&zLine[i], "variable=", 9)==0 ){ aEntry[nUsed].zVar = string_dup(&zLine[i+9], j-9); }else{ |
︙ |