rdiffweb 2.11.2__tar.gz → 2.11.4__tar.gz

{rdiffweb-2.11.2/rdiffweb.egg-info → rdiffweb-2.11.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rdiffweb
-Version: 2.11.2
+Version: 2.11.4
 Summary: A web interface to rdiff-backup repositories.
 Author-email: Patrik Dufresne <patrik@ikus-soft.com>
 License:                     GNU GENERAL PUBLIC LICENSE
@@ -851,7 +851,28 @@ We are passionate about developing and maintaining this open-source project to m
 
 # Changelog
 
-# 2.11.0 (2025-01-14)
+## 2.11.4 (2026-04-23)
+
+* **Bug Fixes:**
+  * db: fix user deletion raising foreign key errors
+
+## 2.11.3 (2026-04-09)
+
+* **Security Fixes:**
+  * api: restrict `/api/users` endpoint to administrators only
+
+## 2.11.2 (2026-04-07)
+
+* **Bug Fixes:**
+  * smtp: fix encoding for email_from
+
+## 2.11.1 (2026-03-11)
+
+* **Bug Fixes:**
+  * fix: add support for configargparse >= 1.7.5
+  * fix: bookwork test by pinning setuptools version
+
+## 2.11.0 (2025-01-14)
 
 * **New Features**
   * Administrators can disable user accounts (#313).
@@ -890,15 +911,15 @@ We are passionate about developing and maintaining this open-source project to m
   * Dropped Ubuntu Oracular
   * Dropped Debian Bullseye due to backports/EOL.
 
-# 2.10.6 (2025-10-02)
+## 2.10.6 (2025-10-02)
 
 * Security: fix token impersonation vulnerability (CVE-2025-67796).
 
-# 2.10.5 (2025-06-20)
+## 2.10.5 (2025-06-20)
 
 * Send deprecation warning into the logs
 
-# 2.10.4 (2025-06-13)
+## 2.10.4 (2025-06-13)
 
 * **New Features:**
     * Added Swagger documentation for the Rdiffweb API (#325).

{rdiffweb-2.11.2 → rdiffweb-2.11.4}/README.md

@@ -128,7 +128,28 @@ We are passionate about developing and maintaining this open-source project to m
 
 # Changelog
 
-# 2.11.0 (2025-01-14)
+## 2.11.4 (2026-04-23)
+
+* **Bug Fixes:**
+  * db: fix user deletion raising foreign key errors
+
+## 2.11.3 (2026-04-09)
+
+* **Security Fixes:**
+  * api: restrict `/api/users` endpoint to administrators only
+
+## 2.11.2 (2026-04-07)
+
+* **Bug Fixes:**
+  * smtp: fix encoding for email_from
+
+## 2.11.1 (2026-03-11)
+
+* **Bug Fixes:**
+  * fix: add support for configargparse >= 1.7.5
+  * fix: bookwork test by pinning setuptools version
+
+## 2.11.0 (2025-01-14)
 
 * **New Features**
   * Administrators can disable user accounts (#313).
@@ -167,15 +188,15 @@ We are passionate about developing and maintaining this open-source project to m
   * Dropped Ubuntu Oracular
   * Dropped Debian Bullseye due to backports/EOL.
 
-# 2.10.6 (2025-10-02)
+## 2.10.6 (2025-10-02)
 
 * Security: fix token impersonation vulnerability (CVE-2025-67796).
 
-# 2.10.5 (2025-06-20)
+## 2.10.5 (2025-06-20)
 
 * Send deprecation warning into the logs
 
-# 2.10.4 (2025-06-13)
+## 2.10.4 (2025-06-13)
 
 * **New Features:**
     * Added Swagger documentation for the Rdiffweb API (#325).

{rdiffweb-2.11.2 → rdiffweb-2.11.4}/rdiffweb/controller/filter_authorization.py

@@ -19,13 +19,13 @@ import cherrypy
 def is_admin():
     # Validate the permissions.
     if not cherrypy.serving.request.currentuser or not cherrypy.serving.request.currentuser.is_admin:
-        raise cherrypy.HTTPError(404)
+        raise cherrypy.HTTPError(403)
 
 
 def is_maintainer():
     # Validate the permissions.
     if not cherrypy.serving.request.currentuser or not cherrypy.serving.request.currentuser.is_maintainer:
-        raise cherrypy.HTTPError(404)
+        raise cherrypy.HTTPError(403)
 
 
 # Make sure it's running after authentication (priority = 72)

{rdiffweb-2.11.2 → rdiffweb-2.11.4}/rdiffweb/controller/page_admin_users.py

@@ -414,6 +414,7 @@ class AdminUsersPage(Controller):
 
 
 @cherrypy.expose
+@cherrypy.tools.is_admin()
 @cherrypy.tools.required_scope(scope='all,admin_read_users')
 class AdminApiUsers(Controller):
     ROLES_MAP = {v: k for k, v in UserObject.ROLES.items()}

{rdiffweb-2.11.2 → rdiffweb-2.11.4}/rdiffweb/controller/tests/test_page_admin.py

@@ -39,4 +39,4 @@ class AdminPagesAsUser(rdiffweb.test.WebCase):
     )
     def test_forbidden_access(self, value):
         self.getPage(value)
-        self.assertStatus(404)
+        self.assertStatus(403)

{rdiffweb-2.11.2 → rdiffweb-2.11.4}/rdiffweb/controller/tests/test_page_admin_users.py

@@ -633,6 +633,19 @@ class AdminApiUsersTest(rdiffweb.test.WebCase):
 
     auth = [("Authorization", "Basic " + b64encode(b"admin:admin123").decode('ascii'))]
 
+    def test_not_admin(self):
+        # Given a user (not-admin)
+        user_obj = UserObject(username='newuser').add()
+        user_obj.set_password('gV3NJqqGr5wc8vh')
+        user_obj.commit()
+        auth = [("Authorization", "Basic " + b64encode(b"newuser:gV3NJqqGr5wc8vh").decode('ascii'))]
+
+        # When trying to access /api/users
+        self.getPage('/api/users', headers=auth)
+
+        # Then access is denied
+        self.assertStatus(403)
+
     @parameterized.expand(
         [
             ('with_userid', 0),

{rdiffweb-2.11.2 → rdiffweb-2.11.4}/rdiffweb/controller/tests/test_page_delete.py

@@ -256,7 +256,7 @@ class DeleteRepoTest(rdiffweb.test.WebCase):
 
         # Try to delete own own repo
         self._delete('user', 'testcases', 'testcases')
-        self.assertStatus(404)
+        self.assertStatus(403)
 
         # Check database don't change
         self.assertEqual(['broker-repo', 'testcases'], [r.name for r in user_obj.repo_objs])

{rdiffweb-2.11.2 → rdiffweb-2.11.4}/rdiffweb/controller/tests/test_page_status.py

@@ -117,7 +117,7 @@ class StatusTest(rdiffweb.test.WebCase):
 
         # Browse admin's repos
         self.getPage(url)
-        self.assertStatus(404)
+        self.assertStatus(403)
 
     def test_with_invalid_username(self):
         # Given an invalid repo

{rdiffweb-2.11.2 → rdiffweb-2.11.4}/rdiffweb/core/model/_message.py

@@ -18,7 +18,7 @@ import itertools
 import json
 
 import cherrypy
-from sqlalchemy import Column, String, and_, event, inspect
+from sqlalchemy import Column, String, and_, event, inspect, text
 from sqlalchemy.orm import backref, declared_attr, foreign, relationship, remote
 from sqlalchemy.sql.functions import func
 from sqlalchemy.sql.schema import ForeignKey
@@ -27,7 +27,7 @@ from sqlalchemy.sql.sqltypes import Integer
 import rdiffweb.plugins.db  # noqa
 
 from ._timestamp import Timestamp
-from ._update import column_add, column_exists
+from ._update import column_add, column_exists, constraint_add, constraint_exists, is_sqlite
 
 Base = cherrypy.db.get_base()
 Session = cherrypy.db.get_session()
@@ -113,7 +113,9 @@ class Message(Base):
     model_name = Column(String, nullable=False)
     model_id = Column(Integer, nullable=False)
     model_summary = Column(String, nullable=False, default='', server_default='')
-    author_id = Column(Integer, ForeignKey('users.UserID'), nullable=True)
+    author_id = Column(
+        Integer, ForeignKey('users.UserID', name='fk_messages_author_id', ondelete="SET NULL"), nullable=True
+    )
     author = relationship("UserObject", lazy=False)
     ip_address = Column(String, nullable=False, default='', server_default='')
     user_agent = Column(String, nullable=False, default='', server_default='')
@@ -265,3 +267,14 @@ def update_message_schema(target, conn, **kw):
         column_add(conn, Message.ip_address)
     if not column_exists(conn, Message.user_agent):
         column_add(conn, Message.user_agent)
+
+    # Since 2.11.4 - author_id  ondelete="SET NULL"
+    fk_constraint = next(c for c in Message.__table__.foreign_key_constraints if c.name == 'fk_messages_author_id')
+    if not constraint_exists(conn, fk_constraint):
+        if not is_sqlite(conn):
+            # With postgresql drop previous constraint.
+            conn.execute(
+                text("ALTER TABLE %s DROP CONSTRAINT IF EXISTS %s" % (Message.__tablename__, fk_constraint.name))
+            )
+        # Then add the constraint.
+        constraint_add(conn, fk_constraint)

{rdiffweb-2.11.2 → rdiffweb-2.11.4}/rdiffweb/core/model/tests/test_db_after_create.py

@@ -179,6 +179,48 @@ INSERT INTO sqlite_sequence VALUES('repos',3);
 COMMIT;
 """
 
+# Test messages FOREIGN KEY ondelete="SET NULL".
+SQL_2_11_3 = """
+BEGIN TRANSACTION;
+CREATE TABLE IF NOT EXISTS "messages" (
+    "id" INTEGER NOT NULL,
+    "model_name" VARCHAR NOT NULL,
+    "model_id" INTEGER NOT NULL,
+    "model_summary" VARCHAR NOT NULL DEFAULT '',
+    "author_id" INTEGER,
+    "ip_address" VARCHAR NOT NULL DEFAULT '',
+    "user_agent" VARCHAR NOT NULL DEFAULT '',
+    "type" VARCHAR NOT NULL DEFAULT 'comment',
+    "body" VARCHAR NOT NULL DEFAULT '',
+    "changes" VARCHAR,
+    "date" DATETIME,
+    PRIMARY KEY("id"),
+    FOREIGN KEY("author_id") REFERENCES "users"("UserID")
+);
+CREATE TABLE IF NOT EXISTS "users" (
+    "UserID" INTEGER NOT NULL,
+    "Username" VARCHAR NOT NULL,
+    "Password" VARCHAR NOT NULL,
+    "UserRoot" VARCHAR NOT NULL,
+    "IsAdmin" SMALLINT NOT NULL DEFAULT '0',
+    "UserEmail" VARCHAR NOT NULL DEFAULT '',
+    "RestoreFormat" SMALLINT NOT NULL DEFAULT '1',
+    "role" SMALLINT NOT NULL DEFAULT '10',
+    "fullname" VARCHAR NOT NULL DEFAULT '',
+    "mfa" SMALLINT NOT NULL DEFAULT '0',
+    "lang" VARCHAR NOT NULL DEFAULT '',
+    "timezone" VARCHAR NOT NULL DEFAULT '',
+    "report_time_range" SMALLINT NOT NULL DEFAULT '0',
+    "report_last_sent" DATETIME,
+    "notes" VARCHAR NOT NULL DEFAULT '',
+    "status" VARCHAR NOT NULL DEFAULT '',
+    PRIMARY KEY("UserID" AUTOINCREMENT),
+    CONSTRAINT "users_username_nan_ck" CHECK("Username" REGEXP '^[a-zA-Z][a-zA-Z0-9_.\\-]+$')
+);
+INSERT INTO "users" VALUES (1, 'admin', '$argon2id$v=19$m=65536,t=3,p=4$KrHpfwZ7l50byo6q59sdlA$l+yJKeZ8OxcGKtM8zcGVe5kXokRzKYvYBJSXjIXditc', '/backups/admin', 0, '', 1, 0, '', 0, '', '', 0, NULL, '', '');
+COMMIT;
+"""
+
 
 @parameterized_class(
     [
@@ -187,6 +229,7 @@ COMMIT;
         {"name": "with_duplicate_users", "init_sql": SQL_WITH_DUPLICATE_USERS, "success": False},
         {"name": "with_invalid_usernames", "init_sql": SQL_WITH_INVALID_USERNAMES, "success": False},
         {"name": "with_null_fields", "init_sql": SQL_WITH_NULL_FIELDS, "success": True},
+        {"name": "with_fk_ondelete_set_null", "init_sql": SQL_2_11_3, "success": True},
     ]
 )
 @skipIf(os.environ.get('RDIFFWEB_TEST_DATABASE_URI'), 'custom database')

{rdiffweb-2.11.2 → rdiffweb-2.11.4}/rdiffweb/core/model/tests/test_user.py

@@ -24,7 +24,7 @@ from sqlalchemy.exc import IntegrityError
 
 import rdiffweb.test
 from rdiffweb.core import authorizedkeys
-from rdiffweb.core.model import RepoObject, UserObject
+from rdiffweb.core.model import Message, RepoObject, UserObject
 from rdiffweb.core.passwd import check_password
 
 
@@ -282,10 +282,19 @@ class UserObjectTest(rdiffweb.test.WebCase):
         self.listener.user_password_changed.assert_called_once_with(userobj)
 
     def test_delete_user(self):
-        # Given an existing user in database
-        userobj = UserObject.add_user('vicky')
+        # Given an existing user in database with some data
+        userobj = UserObject.add_user('vicky', password='test123', user_root=os.path.join(self.testcases, 'testcases'))
+        userobj.add_authorizedkey(self._read_ssh_key())
+        userobj.add_access_token('test')
+        userobj.refresh_repos()
+        userobj.commit()
+        self.assertTrue(userobj.authorizedkeys)
+        self.assertTrue(userobj.tokens)
+        self.assertTrue(userobj.repo_objs)
+        userobj.repo_objs[0].add_message(Message(body='foo bar', author=userobj))
         userobj.commit()
-        self.assertIsNotNone(UserObject.get_user('vicky'))
+        # Wait for login message to be logged
+        cherrypy.scheduler.wait_for_jobs()
         # When deleting that user
         userobj.delete()
         userobj.commit()

{rdiffweb-2.11.2 → rdiffweb-2.11.4/rdiffweb.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rdiffweb
-Version: 2.11.2
+Version: 2.11.4
 Summary: A web interface to rdiff-backup repositories.
 Author-email: Patrik Dufresne <patrik@ikus-soft.com>
 License:                     GNU GENERAL PUBLIC LICENSE
@@ -851,7 +851,28 @@ We are passionate about developing and maintaining this open-source project to m
 
 # Changelog
 
-# 2.11.0 (2025-01-14)
+## 2.11.4 (2026-04-23)
+
+* **Bug Fixes:**
+  * db: fix user deletion raising foreign key errors
+
+## 2.11.3 (2026-04-09)
+
+* **Security Fixes:**
+  * api: restrict `/api/users` endpoint to administrators only
+
+## 2.11.2 (2026-04-07)
+
+* **Bug Fixes:**
+  * smtp: fix encoding for email_from
+
+## 2.11.1 (2026-03-11)
+
+* **Bug Fixes:**
+  * fix: add support for configargparse >= 1.7.5
+  * fix: bookwork test by pinning setuptools version
+
+## 2.11.0 (2025-01-14)
 
 * **New Features**
   * Administrators can disable user accounts (#313).
@@ -890,15 +911,15 @@ We are passionate about developing and maintaining this open-source project to m
   * Dropped Ubuntu Oracular
   * Dropped Debian Bullseye due to backports/EOL.
 
-# 2.10.6 (2025-10-02)
+## 2.10.6 (2025-10-02)
 
 * Security: fix token impersonation vulnerability (CVE-2025-67796).
 
-# 2.10.5 (2025-06-20)
+## 2.10.5 (2025-06-20)
 
 * Send deprecation warning into the logs
 
-# 2.10.4 (2025-06-13)
+## 2.10.4 (2025-06-13)
 
 * **New Features:**
     * Added Swagger documentation for the Rdiffweb API (#325).