rdiffweb 7.2.0b1__tar.gz → 7.2.0b2__tar.gz

{rdiffweb-7.2.0b1 → rdiffweb-7.2.0b2}/CHANGELOG.md

@@ -445,7 +445,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 ### Fixed
 
 - Fix exception raised for invalid locale identifier ([17c6d10](https://gitlab.com/ikus-soft/rdiffweb/commit/17c6d10a5a50d46218649c708a030e6f43d6620e) by Patrik Dufresne).
-- Fix token impersonation vulnerability ([4ce35fc](https://gitlab.com/ikus-soft/rdiffweb/commit/4ce35fc2d23ac1cc789186f32bf76603b2eddeb3) by Patrik Dufresne).
+- Fix token impersonation vulnerability CVE-2025-67796 ([4ce35fc](https://gitlab.com/ikus-soft/rdiffweb/commit/4ce35fc2d23ac1cc789186f32bf76603b2eddeb3) by Patrik Dufresne).
 - Fix selenium execution with bookworm ([1fd8db3](https://gitlab.com/ikus-soft/rdiffweb/commit/1fd8db32b9eb738168f5b1b126f020652674be9d) by Patrik Dufresne).
 - Fix doc upload #337 ([6d7219b](https://gitlab.com/ikus-soft/rdiffweb/commit/6d7219bd4348ad28e1704a4d708111751151fddc) by Patrik Dufresne).
 

{rdiffweb-7.2.0b1 → rdiffweb-7.2.0b2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rdiffweb
-Version: 7.2.0b1
+Version: 7.2.0b2
 Summary: A web interface to rdiff-backup repositories.
 Author-email: Patrik Dufresne <patrik@ikus-soft.com>
 License:                     GNU GENERAL PUBLIC LICENSE

rdiffweb-7.2.0b2/SECURITY.md

@@ -0,0 +1,33 @@
+# Reporting a Vulnerability
+
+If you discover a security vulnerability in Rdiffweb, please report it privately through GitLab:
+
+1. Open a **[New Confidential Issue](https://gitlab.com/ikus-soft/rdiffweb/-/issues/new?issue%5Bconfidential%5D=true)**.
+2. Make sure the **"This issue is confidential"** checkbox is checked.
+3. Include the affected version, description, and steps to reproduce (PoC).
+
+Thank you for improving the security of Rdiffweb.
+
+## Non-qualifying reports
+
+The following are generally **not** considered security vulnerabilities. Please do not report them as such;
+open a regular (public) issue or merge request instead if you believe they are worth improving.
+
+- **Content Security Policy (CSP) configuration**: Use of `unsafe-inline` or `unsafe-eval`, or any other
+  permissive or missing CSP directive, without a working exploit that does not depend on the CSP itself.
+  CSP is a defense-in-depth layer, not Rdiffweb's primary protection against XSS. Rdiffweb's web interface
+  currently relies on inline scripts and styles.
+- **Weak TLS / SSL configuration**: TLS is expected to be terminated by the reverse proxy.
+- **Clickjacking** without a demonstrated impact on a sensitive action.
+- **Self-XSS**, or XSS requiring the victim to paste code into their own browser console.
+- **XSS or content injection by administrators**: administrators are trusted by design.
+- **Unsupported browsers**: issues that only affect outdated browsers or require relaxed browser security settings.
+- **Vulnerabilities in third-party dependencies** without a demonstrated exploit path in Rdiffweb.
+- **Findings from automated scanners** submitted without manual verification and a working proof of concept.
+- **Misconfiguration of a deployment** (reverse proxy, OS, container) outside Rdiffweb's default configuration.
+- **Code paths unreachable in a supported installation**: weaknesses that only occur when a declared
+  dependency is missing, removed, or deliberately bypassed (e.g. `--no-deps`), or in an environment that
+  Rdiffweb does not support. A report must demonstrate that the issue is reachable in a default,
+  supported installation.
+
+Reports in these categories may be closed without a detailed response.

{rdiffweb-7.2.0b1 → rdiffweb-7.2.0b2}/rdiffweb/controller/tests/test_controller.py

@@ -86,6 +86,11 @@ class ControllerTest(rdiffweb.test.WebCase):
         self.getPage('/static//../../test.js')
         self.assertStatus(403)
 
+    def test_dt_language(self):
+        for locale in ['en', 'fr', 'fr_CA']:
+            self.getPage(f'/static/dt-language/{locale}')
+            self.assertStatus(200)
+
 
 class ControllerExternalUrlTest(rdiffweb.test.WebCase):
     default_config = {'external_url': 'https://www.example.com'}

{rdiffweb-7.2.0b1 → rdiffweb-7.2.0b2}/rdiffweb/controller/tests/test_page_history.py

@@ -15,6 +15,7 @@
 # along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 import os
+from pathlib import Path
 
 import cherrypy
 from selenium.webdriver.common.action_chains import ActionChains
@@ -35,6 +36,37 @@ class HistoryPageTest(rdiffweb.test.WebCase):
         self.getPage(url)
         self.assertStatus('200 OK')
 
+    def test_history_path_traversal(self):
+        # Given a user with single repo
+        user = UserObject.get_user(self.USERNAME)
+        (Path(self.testcases) / 'broker-repo').rename(Path(self.testcases) / 'testcases-secret')
+        user.refresh_repos(delete=True)
+        user.commit()
+        self.assertEqual(['testcases', 'testcases-secret'], [r.name for r in user.repo_objs])
+        # When browsing /history/user/test/../testing
+        self.getPage('/history/admin/testcases/%2e%2e/testcases-secret')
+        # Then an error should be raised.
+        self.assertStatus(403)
+
+    def test_history_with_single_repo(self):
+        """
+        Verify if browsing '/history/' for a single repository is working.
+        """
+        # Change the user setting to match single repo.
+        user = UserObject.get_user(self.USERNAME)
+        user.user_root = os.path.join(self.testcases, 'testcases')
+        user.refresh_repos(delete=True)
+        user.commit()
+        self.assertEqual([''], [r.name for r in user.repo_objs])
+        # Check if browsing is working.
+        self.getPage('/history/admin')
+        self.assertStatus('200 OK')
+        self.assertInBody('Files')
+        # Check sub directory browsing
+        self.getPage('/history/admin/Revisions/')
+        self.assertStatus('200 OK')
+        self.assertInBody('Files')
+
     def test_history_with_root(self):
         self._history(self.USERNAME, self.REPO, limit=10)
         # Check revisions

{rdiffweb-7.2.0b1 → rdiffweb-7.2.0b2}/rdiffweb/controller/tests/test_page_login.py

@@ -90,6 +90,7 @@ class LoginPageTest(rdiffweb.test.WebCase):
         cherrypy.scheduler.wait_for_jobs()
         user = UserObject.get_user(self.USERNAME)
         self.assertEqual("User login to web application", user.messages[-1].body)
+        self.assertEqual(userobj.id, user.messages[-1].author_id)
 
     def test_login_case_insensitive(self):
         # When authenticating with valid credentials with all uppercase username

{rdiffweb-7.2.0b1 → rdiffweb-7.2.0b2}/rdiffweb/core/librdiff.py

@@ -53,6 +53,16 @@ STDOUT_ENCODING = 'utf-8'
 LANG = "en_US." + STDOUT_ENCODING
 
 
+def _is_child_of(child, parent):
+    """
+    Return True if the child is relative to parent path or False.
+    This method is string-based.
+    """
+    child = os.path.normpath(child)
+    parent = os.path.normpath(parent)
+    return child == parent or child.startswith(parent.rstrip(b'/') + b'/')
+
+
 def rdiff_backup_version():
     """
     Get rdiff-backup version
@@ -996,9 +1006,9 @@ class RdiffRepo(object):
         """Return a new instance of DirEntry to represent the given path."""
         # Compute increment directory location.
         assert isinstance(path, bytes)
-        full_path = os.path.normpath(os.path.join(self.full_path, path.strip(b'/')))
-        increment_path = os.path.normpath(os.path.join(self._increment_path, path.strip(b'/'), b'..'))
-        if not full_path.startswith(self.full_path) or not increment_path.startswith(self.full_path):
+        full_path = os.path.join(self.full_path, path.strip(b'/'))
+        increment_path = os.path.dirname(os.path.join(self._increment_path, path.strip(b'/')))
+        if not _is_child_of(full_path, self.full_path) or not _is_child_of(increment_path, self.full_path):
             raise AccessDeniedError('%s make reference outside the repository' % self._decode(path))
         relative_path = os.path.relpath(full_path, self.full_path)
         if relative_path.startswith(RDIFF_BACKUP_DATA):

{rdiffweb-7.2.0b1 → rdiffweb-7.2.0b2}/rdiffweb/core/model/_message.py

@@ -14,9 +14,12 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
+import contextvars
 import itertools
 import json
 import logging
+from collections import namedtuple
+from contextlib import contextmanager
 
 import cherrypy
 import cherrypy_foundation.plugins.db  # noqa
@@ -64,6 +67,35 @@ class JSONString(TypeDecorator):
             return None
 
 
+class _MessageContext(
+    namedtuple('_MessageContext', ['author', 'author_id', 'author_username', 'ip_address', 'user_agent'])
+):
+
+    def __new__(cls, author=None, author_id=None, author_username='', ip_address='', user_agent=''):
+        # Derive id/username from the author when one is provided.
+        if author is not None:
+            author_id = author.id
+            author_username = author.username
+        return super().__new__(cls, author, author_id, author_username, ip_address, user_agent)
+
+    def _replace(self, **kwds):
+        if 'author' in kwds and kwds['author'] is not None:
+            kwds.setdefault('author_id', kwds['author'].id)
+            kwds.setdefault('author_username', kwds['author'].username)
+        return super()._replace(**kwds)
+
+    @contextmanager
+    def use(self):
+        ctx = (
+            self._replace(author=None) if self.author and inspect(self.author).session != cherrypy.db.session else self
+        )
+        token = Message._context_var.set(ctx)
+        try:
+            yield self
+        finally:
+            Message._context_var.reset(token)
+
+
 def get_model_changes(model):
     """
     Return a dictionary containing changes made to the model since it was
@@ -142,12 +174,14 @@ class Message(Base):
     changes = Column('changes', JSONString, nullable=True)
     date = Column(Timestamp(timezone=True), default=func.now())
 
+    _context_var = contextvars.ContextVar('message_context', default=None)
+
     def __init__(self, **kwargs):
         """
         Called only when creating a NEW instance, not when loading from DB.
         """
         super().__init__(**kwargs)
-        self._initialize_from_session()
+        self._initialize_from_context()
 
     @property
     def model_object(self):
@@ -164,26 +198,57 @@ class Message(Base):
             self.author_username = value.username
         return value
 
-    def _initialize_from_session(self):
-        """Populate fields from the current CherryPy session/request."""
-        request = cherrypy.request
-        try:
-            if not self.author:
-                self.author = request.currentuser
-        except AttributeError:
-            pass  # No active request/user
-
-        try:
-            if not self.ip_address:
-                self.ip_address = request.remote.ip or ''
-        except AttributeError:
-            pass
+    def _initialize_from_context(self):
+        """
+        Populate fields from the current execution context: either the live
+        CherryPy request (the common case), or a propagated ExecutionContext
+        installed via `copy_context()` in a background thread.
+        """
+        ctx = Message._current_context()
+        if not self.author and ctx.author is not None:
+            self.author = ctx.author
+        if not self.author_id and ctx.author_id:
+            self.author_id = ctx.author_id
+        if not self.author_username and ctx.author_username:
+            self.author_username = ctx.author_username
+        if not self.ip_address and ctx.ip_address:
+            self.ip_address = ctx.ip_address
+        if not self.user_agent and ctx.user_agent:
+            self.user_agent = ctx.user_agent
+
+    @staticmethod
+    def capture_context():
+        """
+        Capture author/ip/user-agent from the current CherryPy request.
+        Call this from the HTTP thread before scheduling background work.
+        Returns a context-manager-capable object; use it with `.use()`.
+        """
+        request = getattr(cherrypy, 'request', None)
+        author = getattr(request, 'currentuser', None) if request else None
+        author_id = getattr(author, 'id', None) if author else None
+        author_username = getattr(author, 'username', None) if author else None
+        ip_address = ''
+        user_agent = ''
+        if request is not None:
+            try:
+                ip_address = request.remote.ip or ''
+            except AttributeError:
+                pass
+            try:
+                user_agent = request.headers.get('User-Agent', '')
+            except AttributeError:
+                pass
+        return _MessageContext(
+            author=author,
+            author_id=author_id,
+            author_username=author_username,
+            ip_address=ip_address,
+            user_agent=user_agent,
+        )
 
-        try:
-            if not self.user_agent:
-                self.user_agent = request.headers.get('User-Agent', '')
-        except AttributeError:
-            pass
+    @classmethod
+    def _current_context(cls):
+        return cls._context_var.get() or cls.capture_context()
 
 
 class MessageMixin:

{rdiffweb-7.2.0b1 → rdiffweb-7.2.0b2}/rdiffweb/core/model/_user.py

@@ -21,6 +21,7 @@ import sys
 
 import cherrypy
 from cherrypy_foundation.passwd import check_password, hash_password
+from cherrypy_foundation.tools.i18n import gettext
 from cherrypy_foundation.tools.i18n import gettext_lazy as _
 from sqlalchemy import (
     Boolean,
@@ -42,7 +43,7 @@ from sqlalchemy.ext.hybrid import hybrid_property
 from sqlalchemy.orm import Session, relationship, validates
 
 from ._callbacks import add_post_commit_tasks
-from ._message import AUDIT_IGNORE, MessageMixin, get_model_changes
+from ._message import AUDIT_IGNORE, Message, MessageMixin, get_model_changes
 from ._repo import RepoObject
 from ._session import SessionObject
 from ._sshkey import SshKey
@@ -81,25 +82,38 @@ Base = cherrypy.db.base
 SEP = b'/'
 
 
-def delete_user_with_data(userid):
+def delete_user_with_data(userid, ctx):
     """
     Job to delete user with all data.
     """
     try:
-        # Let start by deleting all repositories from disk.
         userobj = UserObject.get_user(userid)
         username = userobj.username
-        logger.info('deleting user [%s] with data', username)
-        for repoobj in userobj.repo_objs:
-            logger.info('deleting repository [%s]', repoobj.display_name)
-            repoobj.delete_repo()
-        # Finish by deleting the user it self.
-        userobj.delete()
-        userobj.commit()
-        logger.info('user [%s] deleted', username)
     except Exception:
+        logger.warning("deleting user id [%s] failed", userid, exc_info=True)
+        UserObject.session.rollback()
+        raise
+
+    try:
+        with ctx.use():
+            # Let start by deleting all repositories from disk.
+            logger.info('deleting user [%s] with data', username)
+            for repoobj in userobj.repo_objs:
+                logger.info('deleting repository [%s]', repoobj.display_name)
+                repoobj.delete_repo()
+                repoobj.commit()
+            # Finish by deleting the user it self.
+            userobj.delete()
+            userobj.commit()
+            logger.info('user [%s] deleted', username)
+    except Exception:
+        logger.warning("deleting user [%s] failed", username, exc_info=True)
         UserObject.session.rollback()
+        userobj.add_message(Message(body=gettext("Deletion of user failed"), type=Message.TYPE_EVENT))
+        userobj.commit()
         raise
+    finally:
+        UserObject.session.rollback()
 
 
 class UserObject(MessageMixin, Base):
@@ -365,11 +379,16 @@ class UserObject(MessageMixin, Base):
             raise ValueError(_("can't delete admin user"))
         if delete_data:
             self.status = UserObject.STATUS_DELETING
+            self.add_message(Message(body=gettext("Deletion of user has been scheduled."), type=Message.TYPE_EVENT))
             for repoobj in self.repo_objs:
+                repoobj.add_message(
+                    Message(body=gettext("Deletion of repository has been scheduled."), type=Message.TYPE_EVENT)
+                )
                 repoobj._status = RepoObject.STATUS_DELETING
-            add_post_commit_tasks(self.session, 'scheduler:add_job_now', delete_user_with_data, self.id)
+            ctx = Message.capture_context()
+            add_post_commit_tasks(self.session, 'scheduler:add_job_now', delete_user_with_data, self.id, ctx)
         else:
-            # Otherwise, let delete use directly.
+            # Otherwise, let delete user directly.
             return Base.delete(self)
 
     def delete(self):

{rdiffweb-7.2.0b1 → rdiffweb-7.2.0b2}/rdiffweb/core/notification.py

@@ -39,23 +39,20 @@ from rdiffweb.core.model import Message, RepoObject, UserObject
 CONTEXT = 'NOTIFICATION'
 
 
-def _log_user_login(user_id, date, ip_address, user_agent):
+def _log_user_login(ctx):
     """Used to log user loging asynchronously."""
     # Make sure to start from a clean session.
     cherrypy.db.clear_sessions()
     # Log event
     with cherrypy.db.session.begin():
-        user = UserObject.get_user(user_id)
-        user.add_message(
-            Message(
-                body=_("User login to web application"),
-                type=Message.TYPE_EVENT,
-                date=date,
-                ip_address=ip_address,
-                user_agent=user_agent,
-                author=user,
+        author = UserObject.get_user(ctx.author_id)
+        with ctx.use():
+            author.add_message(
+                Message(
+                    body=_("User login to web application"),
+                    type=Message.TYPE_EVENT,
+                )
             )
-        )
 
 
 class NotificationPlugin(SimplePlugin):
@@ -333,15 +330,11 @@ class NotificationPlugin(SimplePlugin):
         )
         # Log user_login in a different thread.
         if hasattr(userobj, 'add_message'):
-            request = cherrypy.serving.request
-            now = datetime.now(timezone.utc)
+            ctx = Message.capture_context()._replace(author=userobj)
             self.bus.publish(
                 'scheduler:add_job_now',
                 _log_user_login,
-                user_id=userobj.id,
-                date=now,
-                ip_address=request.remote.ip,
-                user_agent=request.headers.get('User-Agent', ''),
+                ctx=ctx,
             )
 
     def notification_job(self):

{rdiffweb-7.2.0b1 → rdiffweb-7.2.0b2}/rdiffweb/templates/admin_users.html

@@ -35,7 +35,7 @@
   {% set role_choices = dict(edit_form.role.choices) %}
   {% set mfa_class = {0: 'text-bg-light border', 1: 'bg-success border'} %}
   {% set mfa_choices = dict(edit_form.mfa.choices) %}
-  {% set status_class = {'':'bg-success bg-opacity-10 text-success', currentuser.STATUS_DISABLED:'bg-secondary bg-opacity-10 text-secondary-emphasis', currentuser.STATUS_DELETING:'bg-danger'} %}
+  {% set status_class = {'':'bg-success bg-opacity-10 text-success', currentuser.STATUS_DISABLED:'bg-secondary bg-opacity-10 text-secondary-emphasis', currentuser.STATUS_DELETING:'bg-warning-subtle text-warning-emphasis border-warning-subtle'} %}
   {% set status_label = {'':_('Active'), currentuser.STATUS_DISABLED: _('Disabled'), currentuser.STATUS_DELETING: _('Deleting')} %}
   {% set report_time_range_choices = dict(edit_form.report_time_range.choices) %}
   <RdwTable :buttons="{{ buttons }}" :paging="False" class="border rounded-2">

{rdiffweb-7.2.0b1 → rdiffweb-7.2.0b2}/rdiffweb.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rdiffweb
-Version: 7.2.0b1
+Version: 7.2.0b2
 Summary: A web interface to rdiff-backup repositories.
 Author-email: Patrik Dufresne <patrik@ikus-soft.com>
 License:                     GNU GENERAL PUBLIC LICENSE

rdiffweb-7.2.0b2/rdiffweb.egg-info/scm_version.json

@@ -0,0 +1,8 @@
+{
+  "tag": "7.2.0b2",
+  "distance": 0,
+  "node": "ga4d62f5b86b9c09723dc0229dd0572b5bc8f194d",
+  "dirty": false,
+  "branch": "HEAD",
+  "node_date": "2026-10-09"
+}

rdiffweb-7.2.0b1/SECURITY.md

@@ -1,7 +0,0 @@
-# Reporting a Vulnerability
-
-If you discover a security vulnerability in Rdiffweb, please disclose it directly by email to [info@ikus-soft.com](mailto:info@ikus-soft.com).
-
-We will review your report promptly and work with you to address the issue responsibly.
-
-Thank you for improving the security of Rdiffweb.

rdiffweb-7.2.0b1/rdiffweb.egg-info/scm_version.json

@@ -1,8 +0,0 @@
-{
-  "tag": "7.2.0b1",
-  "distance": 0,
-  "node": "g3fc88732c47a298467c7e0c0e4e774e1f9a7e123",
-  "dirty": false,
-  "branch": "HEAD",
-  "node_date": "2026-09-30"
-}