rdiffweb 2.11.2__tar.gz → 2.11.3__tar.gz

{rdiffweb-2.11.2/rdiffweb.egg-info → rdiffweb-2.11.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rdiffweb
-Version: 2.11.2
+Version: 2.11.3
 Summary: A web interface to rdiff-backup repositories.
 Author-email: Patrik Dufresne <patrik@ikus-soft.com>
 License:                     GNU GENERAL PUBLIC LICENSE
@@ -851,6 +851,22 @@ We are passionate about developing and maintaining this open-source project to m
 
 # Changelog
 
+# 2.11.3 (2026-04-09)
+
+* **Security Fixes:**
+  * api: restrict `/api/users` endpoint to administrators only
+
+# 2.11.2 (2026-04-07)
+
+* **Bug Fixes:**
+  * smtp: fix encoding for email_from
+
+# 2.11.1 (2026-03-11)
+
+* **Bug Fixes:**
+  * fix: add support for configargparse >= 1.7.5
+  * fix: bookwork test by pinning setuptools version
+
 # 2.11.0 (2025-01-14)
 
 * **New Features**

{rdiffweb-2.11.2 → rdiffweb-2.11.3}/README.md

@@ -128,6 +128,22 @@ We are passionate about developing and maintaining this open-source project to m
 
 # Changelog
 
+# 2.11.3 (2026-04-09)
+
+* **Security Fixes:**
+  * api: restrict `/api/users` endpoint to administrators only
+
+# 2.11.2 (2026-04-07)
+
+* **Bug Fixes:**
+  * smtp: fix encoding for email_from
+
+# 2.11.1 (2026-03-11)
+
+* **Bug Fixes:**
+  * fix: add support for configargparse >= 1.7.5
+  * fix: bookwork test by pinning setuptools version
+
 # 2.11.0 (2025-01-14)
 
 * **New Features**

{rdiffweb-2.11.2 → rdiffweb-2.11.3}/rdiffweb/controller/filter_authorization.py

@@ -19,13 +19,13 @@ import cherrypy
 def is_admin():
     # Validate the permissions.
     if not cherrypy.serving.request.currentuser or not cherrypy.serving.request.currentuser.is_admin:
-        raise cherrypy.HTTPError(404)
+        raise cherrypy.HTTPError(403)
 
 
 def is_maintainer():
     # Validate the permissions.
     if not cherrypy.serving.request.currentuser or not cherrypy.serving.request.currentuser.is_maintainer:
-        raise cherrypy.HTTPError(404)
+        raise cherrypy.HTTPError(403)
 
 
 # Make sure it's running after authentication (priority = 72)

{rdiffweb-2.11.2 → rdiffweb-2.11.3}/rdiffweb/controller/page_admin_users.py

@@ -414,6 +414,7 @@ class AdminUsersPage(Controller):
 
 
 @cherrypy.expose
+@cherrypy.tools.is_admin()
 @cherrypy.tools.required_scope(scope='all,admin_read_users')
 class AdminApiUsers(Controller):
     ROLES_MAP = {v: k for k, v in UserObject.ROLES.items()}

{rdiffweb-2.11.2 → rdiffweb-2.11.3}/rdiffweb/controller/tests/test_page_admin.py

@@ -39,4 +39,4 @@ class AdminPagesAsUser(rdiffweb.test.WebCase):
     )
     def test_forbidden_access(self, value):
         self.getPage(value)
-        self.assertStatus(404)
+        self.assertStatus(403)

{rdiffweb-2.11.2 → rdiffweb-2.11.3}/rdiffweb/controller/tests/test_page_admin_users.py

@@ -633,6 +633,19 @@ class AdminApiUsersTest(rdiffweb.test.WebCase):
 
     auth = [("Authorization", "Basic " + b64encode(b"admin:admin123").decode('ascii'))]
 
+    def test_not_admin(self):
+        # Given a user (not-admin)
+        user_obj = UserObject(username='newuser').add()
+        user_obj.set_password('gV3NJqqGr5wc8vh')
+        user_obj.commit()
+        auth = [("Authorization", "Basic " + b64encode(b"newuser:gV3NJqqGr5wc8vh").decode('ascii'))]
+
+        # When trying to access /api/users
+        self.getPage('/api/users', headers=auth)
+
+        # Then access is denied
+        self.assertStatus(403)
+
     @parameterized.expand(
         [
             ('with_userid', 0),

{rdiffweb-2.11.2 → rdiffweb-2.11.3}/rdiffweb/controller/tests/test_page_delete.py

@@ -256,7 +256,7 @@ class DeleteRepoTest(rdiffweb.test.WebCase):
 
         # Try to delete own own repo
         self._delete('user', 'testcases', 'testcases')
-        self.assertStatus(404)
+        self.assertStatus(403)
 
         # Check database don't change
         self.assertEqual(['broker-repo', 'testcases'], [r.name for r in user_obj.repo_objs])

{rdiffweb-2.11.2 → rdiffweb-2.11.3}/rdiffweb/controller/tests/test_page_status.py

@@ -117,7 +117,7 @@ class StatusTest(rdiffweb.test.WebCase):
 
         # Browse admin's repos
         self.getPage(url)
-        self.assertStatus(404)
+        self.assertStatus(403)
 
     def test_with_invalid_username(self):
         # Given an invalid repo

{rdiffweb-2.11.2 → rdiffweb-2.11.3/rdiffweb.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rdiffweb
-Version: 2.11.2
+Version: 2.11.3
 Summary: A web interface to rdiff-backup repositories.
 Author-email: Patrik Dufresne <patrik@ikus-soft.com>
 License:                     GNU GENERAL PUBLIC LICENSE
@@ -851,6 +851,22 @@ We are passionate about developing and maintaining this open-source project to m
 
 # Changelog
 
+# 2.11.3 (2026-04-09)
+
+* **Security Fixes:**
+  * api: restrict `/api/users` endpoint to administrators only
+
+# 2.11.2 (2026-04-07)
+
+* **Bug Fixes:**
+  * smtp: fix encoding for email_from
+
+# 2.11.1 (2026-03-11)
+
+* **Bug Fixes:**
+  * fix: add support for configargparse >= 1.7.5
+  * fix: bookwork test by pinning setuptools version
+
 # 2.11.0 (2025-01-14)
 
 * **New Features**