Infra
/
lemur
5
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
lemur/lemur
History
Marti Raudsepp cf805f530f Prevent unintended access to sensitive fields (passwords, private keys) (#876) 
Make sure that fields specified in filter, sortBy, etc. are model fields
and may be accessed. This is fixes a potential security issue.

The filter() function allowed guessing the content of password hashes
one character at a time.

The sort() function allowed the user to call an arbitrary method of an
arbitrary model attribute, for example sortBy=id&sortDir=distinct would
produce an unexpected error.
 		2017-08-16 09:38:42 -07:00
..
auth Catch OAuth providers that want the params sent as data (#800) 2017-05-25 10:21:29 -07:00
authorities Fixes bug where authority status was not set correctly. (#739) 2017-03-29 10:10:51 -07:00
certificates Prevent unintended access to sensitive fields (passwords, private keys) (#876) 2017-08-16 09:38:42 -07:00
common Adding additional failure conditions to sentry tracking. (#853) 2017-07-13 14:49:04 -07:00
defaults Minor documentation fixes/tweaks (#597) 2016-12-14 09:29:04 -08:00
deployment Adding the ability to specify a per-certificate rotation policy. (#851) 2017-07-12 16:46:11 -07:00
destinations Adds the ability for destination plugins to be sub-classed from Expor… (#839) 2017-06-26 12:03:24 -07:00
domains Fixes issue where domains without any associated certificates are not searchable. (#797) 2017-05-15 19:07:32 -07:00
endpoints Adding additional failure conditions to sentry tracking. (#853) 2017-07-13 14:49:04 -07:00
logs Add auditing for creating or updating a cert. (#845) 2017-07-04 06:39:16 -07:00
migrations Adding enum migration. (#852) 2017-07-13 13:12:53 -07:00
notifications Adding additional failure conditions to sentry tracking. (#853) 2017-07-13 14:49:04 -07:00
plugins Update readme.txt (#869) 2017-08-04 12:42:27 -07:00
policies Adding the ability to specify a per-certificate rotation policy. (#851) 2017-07-12 16:46:11 -07:00
reporting Adding additional reporting and refactoring existing setup. (#620) 2016-12-20 12:48:14 -08:00
roles Prevent unintended access to sensitive fields (passwords, private keys) (#876) 2017-08-16 09:38:42 -07:00
sources Adding additional failure conditions to sentry tracking. (#853) 2017-07-13 14:49:04 -07:00
static/app Adds the ability for destination plugins to be sub-classed from Expor… (#839) 2017-06-26 12:03:24 -07:00
tests Prevent unintended access to sensitive fields (passwords, private keys) (#876) 2017-08-16 09:38:42 -07:00
users Prevent unintended access to sensitive fields (passwords, private keys) (#876) 2017-08-16 09:38:42 -07:00
__about__.py Version bump. (#751) 2017-04-08 13:23:48 -07:00
__init__.py adding additional status code metrics (#555) 2016-12-02 13:02:59 -08:00
constants.py Pleasing the PEP8 gods 2015-07-21 13:06:13 -07:00
database.py Prevent unintended access to sensitive fields (passwords, private keys) (#876) 2017-08-16 09:38:42 -07:00
decorators.py Fixing a few syntax errors 2015-08-03 21:16:55 -07:00
default.conf.py clean out ADMINS references (#495) 2016-11-15 16:43:28 -08:00
exceptions.py Prevent unintended access to sensitive fields (passwords, private keys) (#876) 2017-08-16 09:38:42 -07:00
extensions.py supporting the ability to push exceptions to sentry (#843) 2017-06-29 14:12:38 -07:00
factory.py supporting the ability to push exceptions to sentry (#843) 2017-06-29 14:12:38 -07:00
manage.py Adding the ability to specify a per-certificate rotation policy. (#851) 2017-07-12 16:46:11 -07:00
metrics.py Closes #216 2016-04-01 16:54:33 -07:00
models.py Adds migration to fix keys on unique index. Closes #743. (#785) 2017-05-10 12:13:42 -07:00
pytest.py adding test utils 2015-07-07 15:32:55 -07:00
schemas.py Adding the ability to specify a per-certificate rotation policy. (#851) 2017-07-12 16:46:11 -07:00
utils.py Minor documentation fixes/tweaks (#597) 2016-12-14 09:29:04 -08:00