roundup-users Mailing List for Roundup Issue Tracker

Hello all:

Roundup 2.4.0 x86_64 docker images are up and tested. Use:

   docker pull rounduptracker/roundup:latest

to track the latest release (it used to point to 2.3.0 and will point
to the newest release).

   docker pull rounduptracker/roundup:2.4.0

to point to newest 2.4.0 release.

   docker pull rounduptracker/roundup:2.4.0-1

to point to exactly this release every time.

Also for those on other architectures:

   docker pull rounduptracker/roundup-development:multi

is currently 2.4.0-1 for:

  x86,
  x86_64,
  arm v7,
  arm64

I currently have the arm64 version running in kubernetes (k3s) on an
odroid-C4.

Also to those people who update other pages that advertise Roundup
(e.g. German/French Wikipedia), please update them for 2.4.0.

--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.

Hi all:

I'm proud to release version 2.4.0 of the Roundup issue
tracker.  This release is a bugfix and feature release, so
make sure to read `docs/upgrading.txt
<https://www.roundup-tracker.org/docs/upgrading.html>`_ to
bring your tracker up to date.

The 79 changes, as usual, include some new features and many
bug fixes.

Version 2.4.0 will be the last release to support Python
2. The next minor release, planned for mid 2025, will occur
5 years after Roundup started supporting Python 3.

Note that you should run ``roundup-admin ... migrate`` to
update the database schema version. Do this before you use
the web, command-line or mail interface and before any users
access the tracker.

You can install it with::

   pip install roundup

(preferably in a virtual environment). To download it, use::

   pip download roundup

then unpack and test/install from the tarball.

Among the notable improvements in 2.4.0 from the 2.3.0
release are:

* three CVE's have been fixed. One requires changes to your
  tracker's home directory. The other two are fixed by
  installing 2.4.0.  See
  https://www.roundup-tracker.org/docs/security.html for
  details and instructions on how to fix these in 2.4.0 and
  earlier releases.

* new classhelper component thanks to a team of students
  from CS682 at U-Mass Boston. This fixes many issues with
  the old classhelper. It is implemented as a web-component
  and needs REST interface access. It will fall back to the
  classic classhelper if REST is not available or if the
  browser does not support web-components.

* fix Windows Python installation using pip. It used to go
  into an infinite loop during install or download. Also fix
  installation of shared files (templates) so roundup-admin
  can find them.

* using ``@current_user`` as a value in a search URL for a
  user property will use the current logged in user. Now you
  can share searches like: "My issues" as "my" will become
  the current logged in user.

* login failures to the REST/XML-RPC interfaces are now rate
  limited to limit password guessing attacks.

* utf8mb4 is the default charset for MySQL. This requires
  migrating your database using the mysql client. You can
  choose to keep the older character set in config.ini.

* PostgreSQL services defined in pg_service.conf can be
  used.  PostgreSQL schemas are supported to eliminate the
  need for the roundup user to have database
  creation/deletion privileges.

* fix out of memory issue when importing larger trackers
  into PostgreSQL.

* multiple roundup-admin improvements: display protected
  properties (like creation date), better formatting of
  output, command history. Also on windows, pyreadline3 is
  supported to provide an editable interactive command line.

* an experimental wsgi performance improvement in 2.3.0 is
  now now the default and is opt-out.

* new template functions: utils.readfile and
  utils.expandfile. Javascript that is included in the
  Python core will be moved to external files and be able to
  have values from Roundup substituted in the Javascript.

* allow content-type of a template to be set from inside the
  template.  This allows returning json or xml from a
  template without a .json or .xml extention.

* fix import/export on windows to use Unix style line
  endings fixing export/import on Windows and making exports
  portable across platforms.

* various other Windows platform fixes including test suite
  fixes.

* sqlite version 1 and StructuredText support removed.

The file CHANGES.txt has a detailed list of feature
additions and bug fixes for each release. The most recent
changes from there are at the end of this announcement. Also
see the information in doc/upgrading.txt.

If you find bugs, please report them to issues AT
roundup-tracker.org or create an account at
https://issues.roundup-tracker.org and open a new ticket. If
you have patches to fix the issues they can be attached to
the email or uploaded to the tracker.

Upgrading
=========

If you're upgrading from an older version of Roundup you
*must* follow all the "Software Upgrade" guidelines given in
the doc/upgrading.txt documentation.

Note that you should run ``roundup-admin ... migrate`` for
all your trackers to update the database schema version. Do
this before you use the web, command-line or mail interface
and before any users access the tracker.

Roundup requires Python 2 newer than version 2.7.12 or Python 3
newer than or equal to version 3.6 for correct operation. (Python
3.4 or 3.5 may work, but are not tested.) Note that Roundup 2.4.0
will be the last release to support Python 2. You should deploy
new trackers with Python 3 and plan on upgrading older trackers
from Python 2 to Python 3. See the upgrade guide.

To give Roundup a try, just download (directions above),
unpack and run::

    python demo.py

then open the url printed by the demo app.

Release info and download page:

     https://pypi.org/project/roundup/

Source and documentation is available at the website:

     https://www.roundup-tracker.org/

Mailing lists - the place to ask questions:

     https://sourceforge.net/p/roundup/mailman/


About Roundup
=============

Roundup is a simple-to-use and install issue-tracking system
with command-line, web and e-mail interfaces. It is based on
the winning design from Ka-Ping Yee in the Software
Carpentry "Track" design competition.

Roundup manages a number of issues (with flexible properties
such as "description", "priority", and so on) and provides
the ability to:

(a) submit new issues,
(b) find and edit existing issues, and
(c) discuss issues with other participants.

The system facilitates communication among the participants
by managing discussions and notifying interested parties
when issues are edited. One of the major design goals for
Roundup that it be simple to get going. Roundup is therefore
usable "out of the box" with any Python 3.6+
installation. It doesn't even need to be "installed" to be
operational, though an install script is provided.

It comes with five basic issue tracker templates

* a classic bug/feature tracker
* a more extensive devel tracker for bug/features etc.
* a responsive version of the devel tracker
* a jinja2 version of the devel template (work in progress)
* a minimal skeleton

and supports four database back-ends (anydbm, sqlite, mysql
and postgresql).

Recent Changes
==============

>From 2.3.0 to 2.4.0

Fixed:

- CVE-2024-39124 - The classhelpers (_generic.help.html) are
  vulnerable to an XSS attack. A specially crafted URL that used
  that endpoint would result in running a script embedded in the
  URL. (Found/reported by Alec Romano (4rdr), fix/tests John
  Rouillard)
- CVE-2024-39125 - If the Referer header is set to a script tag,
  it will be executed when the error in the Referer header is
  reported. (Found/reported by Alec Romano (4rdr), fix/tests John
  Rouillard)
- CVE-2024-39126 - PDF, XML and SVG files attached to an issue can contain
  embedded JavaScript. This JavaScript was executed when the file was
  accessed. PDF files are now downloaded and not displayed in the
  browser. A content security policy is added for all download files
  which prevents code execution in SVG files.  (Found/reported by Alec
  Romano (4rdr), fix/tests John Rouillard)
- issue2551282 - MySQL utf8mb4 issues and
  issue2551115 - Use utf8mb4 as a default for MySQL instead of utf8
  The default database type and collations have been set to:
  utf8mb4, utf8mb4_unicode_ci and utf8mb4_0900_bin. They are (sadly)
  configurable from config.ini. Require directions on upgrading the
  MySQL db have been documented in upgrading.txt.
- issue2551063 - Rest/Xmlrpc interfaces needs failed login protection.
  Failed API login rate limiting with expiring lockout added. (John
  Rouillard)
- issue2551184 - improve i18n handling. Patch to test to make sure it
  uses the test tracker's locale files and not other locale
  files. (Marcus Priesch)
- issue2551283 - fail if version 2.4.9 of markdown2 is used, it broke
  [issue1](issue1) style links. Support markdown2 2.4.8 and earlier
  and 2.4.10 with its new schema filtering method. (John Rouillard)
- multiple flake8 fixes (John Rouillard)
- rename loop variable in 'for sendto in sendto:' (John Rouillard)
- issue2551193 - Fix roundup for removal of cgi and cgitb standard
  python modules (and FieldStorage/MiniFieldStorage). Replaced imports
  from cgi to use roundup.anypy.cgi\_ which will load the system cgi
  unless it is missing. Then it will load roundup.anypy.vendored.cgi
  and make \*FieldStorage symbols available. Roundup uses its own
  cgitb.py and not the system cgitb.py. It looks like it's the
  precursor to the system cgitb.py. (John Rouillard)
- issue2551278 - datetime.datetime.utcnow deprecation. Replace
  calls with equivalent that produces timezone aware dates rather than
  naive dates. (John Rouillard)
- when using "roundup-admin display" indent the listing only if
  headers or protected fields are requested. This makes the output
  look like it did previously to 2.3.0 if the new features aren't
  used.  Roundup-admin output was never meant to be machine parsed, but
  don't break it unless required. (John Rouillard)
- issue2551290 - pip install roundup Hangs on Windows 10
  The install under windows goes into an infinite loop using pip or
  source install. (John Rouillard)
- Document use of pyreadline3 to allow roundup-admin to have CLI editing
  on windows. (John Rouillard)
- issue2551293 - remove schema_hook from Tracker instance. Looks like
  it was an obsolete hook used for testing. Never documented and not
  accessible from schema.py.
- Fix roundup-admin security command. Lowercase its optional
  argument. Roles are indexed by lower case role name. So 'security
  User' and 'security user' should generate the same output. (John
  Rouillard from issue on mailing list by Chuck Cunningham)
- make roundup-server exit more quickly on ^C. This seems to be
  limited to windows. (John Rouillard)
- Fix error handling so failure during import of a non-user item
  doesn't cause a second traceback. (Found by Norbert Schlemmer, fix
  John Rouillard)
- Handle out of memory error when importing large trackers in
  PostgreSQL. (Found by Norbert Schlemmer, extensive testing by
  Norbert, fix John Rouillard)
- use unittest.mock rather than mock for
  test/test_hyperdbvals.py. (found by Ralf Schlatterbeck. Fix John
  Rouillard)
- disable proxy with wget in roundup_healthcheck. (Norbert Schlemmer
  Noschvie on github.com)
- support dicttoxml2.py for Roundup running on 3.7 and
  newer. dicttoxml uses a type alias: collection.Iterator that is
  dropped in Python 3.10. (found by Norbert Schlemmer, fix John
  Rouillard)
- fix duplicate html id 'password' in user.item.html in all templates except
  jinja2. (John Rouillard)
- fix unclosed file when saving index in indexer_dbm.py. (John Rouillard)
- fix task index in devel tracker so it doesn't cause a crash if all
  fields are selected. (John Rouillard)
- fix windows install. When using pip share directory is installed in
  a directory tree under the lib directory. Fix it so that Lib/share
  is used to install the share tree. The lets Roundup find tracker
  templates and translation files. (Found by Simon Eigeldinger, fix
  John Rouillard)
- fix roundup-demo, interactive mode would nuke an existing tracker.
  (Found Tonu Mikk, fix John Rouillard)
- fix detection/reporting when using a SQLite3 library without FTS5
  support. Install docs updated to state that FTS5 support is required
  when using SQLite for back end. (Found Tonu Mikk, fix John
  Rouillard)
- issue2551320: user.help-search.html doesn't respect
  properties. Setting url parameter properties when using the
  classhelp for users now shows the requested properties. (Found by
  Patel Malav and Nikunj Thakkar of the UMass-Boston CS682 Spring
  2024 class; fix John Rouillard)
- use ast.eval_literal() rather than eval() to turn CSV exported
  string values into Python object/values.
- use template's guess at Content-Type in headers only if Content-Type
  is not already set. This allows a template to set its own content
  type. For example: _generic.translate can set content type (via
  request.client.additional_headers) to application/json and return
  json from the template. This json could access the 1i18n functions
  for a javascript helper. (John Rouillard)
- when template processing raises an exception the line number is
  sometimes missing. This causes cgitb to raise a second exception
  which clobbers the info about the template issue. As a stop-gap set
  the line number to -1 so the original traceback can be seen. This
  could be a bug in ZopeTAL. (John Rouillard)
- issue2551328 - REST results show next link if number of results is a
  multiple of page size. There should be no next link. (Found by Patel
  Malav and Bharath Kanama of the UMass-Boston CS682 Spring 2024
  class; fix John Rouillard)
- issue2551264 - REST X-Total-Count header and @total_size count
  incorrect when paginated - correct values are now returned.
  (John Rouillard)
- issue2551331 - Fix repeat first/last methods. (John Rouillard)
- Fix import/export on windows. Use unix line terminating characters.
  (John Rouillard)
- Fix anydbm session/otks clear() method on windows when backed by
  dumbdbm. Also make anydbm detect the initialized database when
  using dumbdbm. (John Rouillard)
- Use of '-' directory in static_files config option under windows
  Python fixed. (John Rouillard)
- issue2551334 - number of test bugs that prevented test suite from
  running under Windows Python are fixed. WIP. (John Rouillard)
- issue2551302 - Remove support for sqlite version 1 from
  back_sqlite.py. We have been using sqlite3 for over a decade. (John
  Rouillard)
- issue2551285 - Remove StructuredText support. reStructuredText is
  still supported. (John Rouillard)
- Use roundup-demo -p option to set listening port. Was ignored
  before. (John Rouillard)
- issue2551346 - Classic tracker's statusauditor raises error if
  detectors/config.ini missing
  STATUSAUDITOR_CHATTING_REQUIRES_TWO_USERS.  The statusauditor.py for
  jinja2 and classic templates has been changed to assume that this
  option is off when the setting is missing from
  detectors/config.ini. Other templates do not implement this option.
  (John Rouillard)
- issue2551350 - Python changes for 3.12 with roundup 2.3.0. Fixes for
  cgitb.py crash due to pydoc.html.header() signature change. (Patch
  by Andrew (kragacles), applied John Rouillard)
- issue2551350 - Python changes for 3.12 with roundup 2.3.0. Fixes for
  mailer.py crash due to change in starttls signature change. (Patch
  by Andrew (kragacles), modified and applied John Rouillard)
- make classhelper link open in a new window by setting
  target="_blank". This prevents overwriting of current page with the
  classhelper if javascript is disabled. (John Rouillard)
- issue2551341 - if @columns missing from an index url, the
  group headers colspan property = 0. Add "or 100" in
  stanza's so headers span all rows (up to 100).
- fix roundup-server response requiring a 301 redirect. Did
  not set content length leading to hang/error. (John
  Rouillard)
- report basename of filename when template file is invalid
  rather than reporting a TypeError. (John Rouillard)
- Make Last-Modified header use GMT not -0000 timezone. Fix error
  reported by redbot testing. (John Rouillard)
- Send Vary: Accept-Encoding on any file that could be compressed
  even if the file is not encoded/compressed. Found by Redbot
  testing. (John Rouillard)
- make If-None-Match work for static file (@@file) case. Found by
  Redbot testing (John Rouillard)
- Send vary: accept-encoding for if-modified-since conditional
  requests where the file is not modified. (John Rouillard)
- Update JWT example in rest.py to use replacement for
  datetime.datetime.utcnow(). (John Rouillard)
- issue2551219 - document requirements of PEM file when using
  roundup-server in SSL/TLS mode. Report better error messages
  when PEM file is missing certificate or private key. (John
  Rouillard)
- Cleanup tracker index generation by roundup-server. Send
  correct Content-Length headers so HTTP/1.1 connections don't
  hang. (John Rouillard)
- Fix delay when using csv export actions. The CSV file is written
  incrementally, so we can't determine the Content-Length. When using
  HTTP/1.1, this causes a delay while the browser waits for a timeout.
  Forcing the connection to close after the CSV file is written
  removes the delay. (John Rouillard)

Features:

- issue2551323 - Remove XHTML support. Disabled option to set
  html_version to xhtml. Running roundup commands with html_version
  set to xhtml will result in an "Invalid value for HTML_VERSION:
  'xhtml'" error. (John Rouillard)
- issue2551103 - add pragma 'display_protected' to roundup-admin. If
  true, print protected attributes like id, activity, actor...
  when using display or specification subcommands. (John Rouillard)
- add -P pragma=value command line option to roundup-admin. Allows
  setting pragmas when using non-interactive mode. (John Rouillard)
- issue685275 - add pragma show_retired to control display of retired
  items when using list/table. Add pragma display_header to print
  headers for display command. Header displays designator and
  retired/active status. (John Rouillard)
- issue2551299 - support config.ini rdbms option 'service'. Allow use
  of a PostgreSQL connection service file (pg_service.conf) for
  configuring database on a per-tracker basis. Also replaces use of
  PGSERVICE env variable for single instance trackers. (From ML
  question by ivanov. John Rouillard)
- issue2550852 - support for specifying a PostgreSQL schema to use for
  the Roundup database. (Patch by Stuart McGraw; slight modifications,
  tests, docs: John Rouillard).
- issue2551274: add configurable logging for REST API when something
  fails, we now log status code and error message.
  (Ralf Schlatterbeck)
- issue2551317 - add some Jinja2 examples to customizing.txt
  document. (John Rouillard)
- multiple scripts/... updates - Python3, linting, enhancements:
  weekly-report,schema-dump.py, roundup-reminder, copy-user.py,
  dump_dbm_sessions_db.py, contributors.py (John Rouillard)
- roundup/msgfile.py can now be called as 'python msgfmt.py de.po de.mo'
  or 'python msgfmt.py -o de.mo de.po' to compile a translation file if
  GNU msgfmt is missing. (John Rouillard)
- save roundup-admin history between sessions. Load
  ~/.roundup_admin_rlrc file to set history-size persistently. Add
  pragma history_length to override for a session. (John Rouillard)
- the roundup-admin history command now dumps the journal entries
  in a more human readable format. Use the raw option to get the older
  machine parsible output. (John Rouillard)
- Multiple JWT secrets are supported to allow key rotation. See
  an updated config.ini for details. (John Rouillard)
- issue2551212 - wsgi performance improvement feature added in 2.2.0
  is active by default. Can be turned off if needed. See upgrading.txt
  for info. (John Rouillard)
- issue2551270 - Better templating support for JavaScript. Add
  utils.readfile(file, optional=False) and utils.expandfile(file,
  token_dict=None, optional=False). Allows reading an external file
  (e.g. JavaScript) and inserting it using tal:contents or equivalent
  jinja function. expandfile allows setting a dictionary and tokens in
  the file of the form "%(token_name)s" will be replaced in the file
  with the values from the dict. (John Rouillard)
- add @group to rest interface collection queries. Useful when using
  optgroup in select elements. (John Rouillard)
- roundup-demo can set the hostname in the URL using the -H
  parameter. So you can start a demo tracker that is available from
  your network using 'roundup-demo ... -B hostname -H hostname'. (John
  Rouillard)
- issue2551347 - make _generic.help.html work without property
  settings. THis applies to classic or minimal trackers. It allows use
  of classhelp without the property seting for informtion only
  (e.g. description of what a priority or status means) without being
  able to select the property in the classhelper.  Good for adding help
  for Link properties. (John Rouilllard)
- issue1525113 - notation to filter by logged-in user. Use
  @current_user with properties that are a Link to the 'user' class to
  match the currently logged in user. Allows sharing of queries like
  "Issues I created" or "Issues I am assigned to" by removing the
  hard coded user id number and replacing it with the current user's
  id. Tracker templates updated to use it. (John Rouillard from a
  patch by Jon C. Thomason)
- Add a /rest/data/user/roles REST endpoint. (John Rouillard)
- issue2551353 - Add roundup-classhelper for 2.4.0
  release. Integrate new classhelper web component to wrap
  existing classhelper link. This fixes a number of
  outstanding bugs against the current classhelper using
  current web features. (Patel Malav, Nikunj Thakkar,
  Bharath Kanama with integration by John Rouillard)
- disable spellcheck on all password fields to try to prevent
  browser from exposing passwords to external servers. (John
  Rouillard)
--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.

On Thu, Jul 11, 2024 at 09:48:46AM -0400, John P. Rouillard wrote:
> 
> Is anybody still running Roundup using Python 2?
> 
> eIf not, 2.4.0 will be the last release to support Python 2. Roundup
> 2.5.0 and newer will support Python 3.8+ (2.4.0 supports Python 3.6+).

I'm no longer using python2, so fine with me if we stop supporting it.

Thanks!
Ralf
-- 
Dr. Ralf Schlatterbeck                  Tel:   +43/2243/26465-16
Open Source Consulting                  www:   www.runtux.com
Reichergasse 131, A-3411 Weidling       email: of...@ru...

Hello all:

I am considering making the 2.4.0 release the last release to support
Python 2. My intent was to support Python 2 for 5 years after
releasing the first version that supported Python 3.

Python 3 support was released in version 2.0.0 on July 13th of 2020.
However in the docs I included a fence post error 8-(. I stated
version 2.5.0 (to be released July 2025) was the last version to
support Python 2, this gives 6 years of Python 2 support not 5.

Is anybody still running Roundup using Python 2?

eIf not, 2.4.0 will be the last release to support Python 2. Roundup
2.5.0 and newer will support Python 3.8+ (2.4.0 supports Python 3.6+).

Feel free to respond to the list, or to me personally.

Have a great day.
--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.

Hello All:

There are three security issues found in Roundup a couple of weeks ago
by Alec Romano.

 * one requires changes to html files in the tracker. (There is a zip
   file you can download with fixed html template files.)

 * the other two are fixed by changing the Roundup source code. (1)

The announcement is at the top of:

  https://www.roundup-tracker.org/docs/security.html

for CVE-2024-39124, CVE-2024-39125, and CVE-2024-39126. It has links
to the CVEs, details on the issues, and remediation directions for each
CVE.

The 2.4.0 Roundup release fixes the issues at (1). It will happen this
weekend, but I wanted to get the CVE announcement out during the
normal work week so it's not announced during the weekend.

The zip file with updated tracker templates has a sha256sum of:

c09e94f3c6756db66d33cc14108f8156ff0167b9ae8edafc0d59e96a761b33e8  CVE-2024-39124-templates.zip

--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.

Hi all:

I know at least one company has developed a React based front end for
Roundup using REST. React based SPA's redraw parts of the page in
response to user interaction speeding up the front end.

I was wondering if there was a way to do rendering of parts of the
page on user interaction without using javascript in the browser to
generate HTML using data obtained via REST.

This method would use server side rendering (SSR) of the HTML. It
would keep all the state on the Roundup server. It would transfer only
the new parts and reduce the transmission size when the user clicked
on something.

Tools like htmx and htmz seem to be useful for this. They get a
fragment of HTML content from the server and use it to replace an
existing element on the web page.

I sketched out a way to get Roundup to produce page fragments (think
of it as returning just the content part of issue.index.html or
issue.item.html). I did this in about 10 lines of changes to
page.html.

You can see my thoughts at:

  https://wiki.roundup-tracker.org/ServingHtmlFragmentsForHtmxHtmz

Have a great week all.

--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.

Hi all:

About a month ago, I privately had a discussion on the IRC server
about turning a Roundup tracker into a static site.

The person wanted to purge a bunch of 10+ year old issues as part of a
Roundup upgrade. However rather than deleting the old issues the
requirement was to archive them. S/He was thinking about making it
into a static site.

I just had a second query about the same thing. I'm hoping the person
who I irc'ed with a month ago is on this list. If you are let me know
if any of the ideas we came up with worked for you. Maybe we can work
out a path for migrating a live roundup instance to an archived static
instance.

Have a great day all.
--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.

Hi everybody:

Has anybody tried the 2.4.0beta release?

I am looking for feedback on any part of the upgrade.  Any feedback on
upgrading your tracker to use the new classhelper component.

Have a great week all.

--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.

Hi David:

In message <382...@po...>,
David Hancock writes:
>Short answer: Problem solved. I was missing permissions for the
>fbcustcomp field in schema.py. I was logged in as ‘admin’ in Safari,
>so could see everything. In Chrome or Firefox I was in a a normal
>user. Apologies for wasting your time on this!

No apology needed.

I don't remember if roundup-admin 1.5.0 has the `security` command, but
if it does you may want to take a look at it. For one of my trackers
it spits out info like:

  Role "user":
   User is allowed to view druid (View for "druid" only)
   User can edit file metadata (Edit for "file" only)
   View private issue acl applies (View for "file" only)
   User can create file (Create for "file" only)
   User is allowed to view filestatus (View for "filestatus" only)
   View issue check private (View for "issue" only)

that may have been helpful (or not) in your investigation.

>For my part, working through your troubleshooting steps was helpful.

Good. Glad it helped.

>I agree about upgrading Roundup. My organization is still on Python
>2.6, for crying out loud, and I despair of getting anything upgraded.

I can understand. Hope you have a good day.

--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.

Short answer: Problem solved. I was missing permissions for the fbcustcomp field in schema.py. I was logged in as ‘admin’ in Safari, so could see everything. In Chrome or Firefox I was in a a normal user. Apologies for wasting your time on this!

For my part, working through your troubleshooting steps was helpful. The html4 setting is right. The dev tools in Firefox showed no problems (except missing favicon.ico), and the HTML is valid, albeit missing fbcustcomp entries unless I was admin. I was about to edit the fbcustcomp entries to “fix" any with accented characters when I realized my mistake.

I agree about upgrading Roundup. My organization is still on Python 2.6, for crying out loud, and I despair of getting anything upgraded.

Anyway, I’m back in action, and appreciate the support.

Cheers!
-- 
David Hancock


On Jun 4, 2024, at 8:30 PM, John P. Rouillard <ro...@cs...> wrote:

Hi David:

In message
<SA1P110MB19304D4AA4304EC9CE3BEDA2CCF8A@SA1P110MB1930.NAMP110.PROD.OUTLOOK.COM>,
"Hancock, David US Professional Services, Inc. \(USP\) via
Roundup-users" writes:
> First, I apologize for asking about such an ancient version of the
> software. This is Roundup 1.5.0 with classic templates. It’s not my
> choice, though.

Understood, I have helped somebody off list with a 1.4.x release so...

Can you verify that html_version in your tracker's config.ini is set
to html4. This is the default and I do not expect it would have been
changed.

> I’ve encountered a situation where Mac Safari displays a pulldown
> menu correctly, but Chrome and Firefox (also on Mac) do not. Chrome
> and Edge on Windows work correctly.

Ok, that's very wierd. Roundup doesn't customize its output based on
the client. The HTML for the menu should be the same for all browsers.

> I’ve got a DB class called fbcustcomp in schema.py as a Link type,
> which is populated with slightly more than 100 company names. The
> .item.html file for this issue type has a table row:
> 
> <tr>
> <th class="required" nowrap>Company</th>
> <td tal:content="structure context/fbcustcomp/menu">fbcustcomp</td>
> </tr>
> 
> In Mac Safari and Windows Chrome or Edge, the full list can be pulled
> down.

That TAL looks fine and since it works with the Safari and Chrome
engines, I am going to say it's valid. Does Firefox on Windows work ok
too?

Can you pull up the developer tools or view the source for the page on
one of these.

> In Mac Chrome or Firefox, the list is empty (“not selected”) on
> a new issue, and if an issue has been edited, there are exactly two
> items in the pulldown (“not selected” and whatever was saved in a
> browser where the pulldown works).

Please compare the dev tools/source on these failing browsers to what
is shown above.

This may give us an idea as to what's happening.

IIUC on a Mac, all browsers (chrome and firefox) use the same safari
engine. So I am surprised at this problem.

> Most of the users are on Windows and Mac Safari works right, so this
> is not even close to an emergency. But if anyone has any thoughts
> about this issue, I’m all ears.

Check to see if any errors are reported in the dev tools
console. There should not be any javascript involved in that select
box, but somebody may have modified it from the default
template. Again, since it works in safari, I expect it to work in
other Mac browsers.

Note, if you have sensitive data in the page this may not be an
option. You can try is to copy the page source and paste it into the
w3 html validator: https://validator.w3.org/. If it returns
errors/warnings, we may have another thing to look at.

> I’m also open to hearing “we haven’t got time to support a
> 15-year-old Roundup—get yourself current!” I’ve got it coming.

A quick search for differences between 1.5.0 and the current head does
show a change in how some data is escaped. I'm not sure why this
change is present. So it could be a red herring. But nothing in the
diff leaps out to me as an attempt to change the generated menu HTML.

In any case, you should look into getting Roundup upgraded. OS support
for Python 2 may be a problem and 1.5.0 won't run under Python 3.

Hopefully this gives you some ideas for exploration.

Have a great day.
--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.


_______________________________________________
Roundup-users mailing list
Rou...@li...
https://lists.sourceforge.net/lists/listinfo/roundup-users

Hi David:

In message
<SA1P110MB19304D4AA4304EC9CE3BEDA2CCF8A@SA1P110MB1930.NAMP110.PROD.OUTLOOK.COM>,
"Hancock, David US Professional Services, Inc. \(USP\) via
Roundup-users" writes:
>First, I apologize for asking about such an ancient version of the
>software. This is Roundup 1.5.0 with classic templates. It’s not my
>choice, though.

Understood, I have helped somebody off list with a 1.4.x release so...

Can you verify that html_version in your tracker's config.ini is set
to html4. This is the default and I do not expect it would have been
changed.

>I’ve encountered a situation where Mac Safari displays a pulldown
>menu correctly, but Chrome and Firefox (also on Mac) do not. Chrome
>and Edge on Windows work correctly.

Ok, that's very wierd. Roundup doesn't customize its output based on
the client. The HTML for the menu should be the same for all browsers.

>I’ve got a DB class called fbcustcomp in schema.py as a Link type,
>which is populated with slightly more than 100 company names. The
>.item.html file for this issue type has a table row:
>
><tr>
><th class="required" nowrap>Company</th>
><td tal:content="structure context/fbcustcomp/menu">fbcustcomp</td>
></tr>
>
>In Mac Safari and Windows Chrome or Edge, the full list can be pulled
>down.

That TAL looks fine and since it works with the Safari and Chrome
engines, I am going to say it's valid. Does Firefox on Windows work ok
too?

Can you pull up the developer tools or view the source for the page on
one of these.

>In Mac Chrome or Firefox, the list is empty (“not selected”) on
>a new issue, and if an issue has been edited, there are exactly two
>items in the pulldown (“not selected” and whatever was saved in a
>browser where the pulldown works).

Please compare the dev tools/source on these failing browsers to what
is shown above.

This may give us an idea as to what's happening.

IIUC on a Mac, all browsers (chrome and firefox) use the same safari
engine. So I am surprised at this problem.

>Most of the users are on Windows and Mac Safari works right, so this
>is not even close to an emergency. But if anyone has any thoughts
>about this issue, I’m all ears.

Check to see if any errors are reported in the dev tools
console. There should not be any javascript involved in that select
box, but somebody may have modified it from the default
template. Again, since it works in safari, I expect it to work in
other Mac browsers.

Note, if you have sensitive data in the page this may not be an
option. You can try is to copy the page source and paste it into the
w3 html validator: https://validator.w3.org/. If it returns
errors/warnings, we may have another thing to look at.

>I’m also open to hearing “we haven’t got time to support a
>15-year-old Roundup—get yourself current!” I’ve got it coming.

A quick search for differences between 1.5.0 and the current head does
show a change in how some data is escaped. I'm not sure why this
change is present. So it could be a red herring. But nothing in the
diff leaps out to me as an attempt to change the generated menu HTML.

In any case, you should look into getting Roundup upgraded. OS support
for Python 2 may be a problem and 1.5.0 won't run under Python 3.

Hopefully this gives you some ideas for exploration.

Have a great day.
--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.

First, I apologize for asking about such an ancient version of the software. This is Roundup 1.5.0 with classic templates. It’s not my choice, though.

I’ve encountered a situation where Mac Safari displays a pulldown menu correctly, but Chrome and Firefox (also on Mac) do not. Chrome and Edge on Windows work correctly.

I’ve got a DB class called fbcustcomp in schema.py as a Link type, which is populated with slightly more than 100 company names. The .item.html file for this issue type has a table row:

<tr>
<th class="required" nowrap>Company</th>
<td tal:content="structure context/fbcustcomp/menu">fbcustcomp</td>
</tr>

In Mac Safari and Windows Chrome or Edge, the full list can be pulled down. In Mac Chrome or Firefox, the list is empty (“not selected”) on a new issue, and if an issue has been edited, there are exactly two items in the pulldown (“not selected” and whatever was saved in a browser where the pulldown works).

Most of the users are on Windows and Mac Safari works right, so this is not even close to an emergency. But if anyone has any thoughts about this issue, I’m all ears.

I’m also open to hearing “we haven’t got time to support a 15-year-old Roundup—get yourself current!” I’ve got it coming.

Cheers!
--
David Hancock

Hi all:

In https://jviide.iki.fi/http-redirects jviide notes that redirecting
http -> https automatically for API calls is not a great idea.

For regular human browser use, credentials aren't usualy sent with the
first http request (it waits for a 401-Unauthorized response). However
for API calls, credentials are usually supplied with the first call to
the API.

Jviide suggests returning a 403 (Forbidden) along with an explanation.
The explanation says that the credentials should be changed, since
they have been exposed in plaintext over the network.

At the very least it stops repeated successful API access over the
insecure path. This should reduce the number of times the credentials
are exposed.

It also suggests automatically voiding the credentials if a request
comes in over http, but that's a whole other issue.

Have a great day all and I hope you are enjoying Roundup 2.4.0beta2.

--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.

On Tue, May 28, 2024 at 02:25:06PM -0400, John P. Rouillard wrote:
> Hello All:
> 
> I'm proud to release version 2.4.0 beta 2 of the Roundup issue
> tracker. This release is a bugfix and feature release, so make
> sure to read docs/upgrading.txt (
> https://www.roundup-tracker.org/dev_docs/docs/upgrading.html) to
> bring your tracker up to date.
> 
> I expect the final release to happen on July 13th.

Thanks!

Kind regards
Ralf
-- 
Dr. Ralf Schlatterbeck                  Tel:   +43/2243/26465-16
Open Source Consulting                  www:   www.runtux.com
Reichergasse 131, A-3411 Weidling       email: of...@ru...

Hello All:

I'm proud to release version 2.4.0 beta 2 of the Roundup issue
tracker. This release is a bugfix and feature release, so make
sure to read docs/upgrading.txt (
https://www.roundup-tracker.org/dev_docs/docs/upgrading.html) to
bring your tracker up to date.

I expect the final release to happen on July 13th.

The 67 changes, as usual, include some new features and many bug
fixes.

See details and cautions on upgrading at:

    https://www.roundup-tracker.org/dev_docs/docs/upgrading.html

Note that you should run `roundup-admin ... migrate` to update the
database schema version. Do this before you use the web, command-line
or mail interface and before any users access the tracker.

You can install it with:

   pip install roundup~=2.4.0b2

(preferably in a new virtual environment). To download it, use:

   pip download roundup~=2.4.0b2

then unpack and test/install from the tarball. Docker users can:

   docker pull rounduptracker/roundup:2.4.0b2

then run it in demo mode using the instructions at:

  https://www.roundup-tracker.org/dev_docs/docs/installation.html#running-=
in-demo-mode-with-docker

using the docker image above. For those on an ARM platform, 2.4.0b2
docker images are available at:

   rounduptracker/roundup-development:multi.

Among the notable improvements in 2.4.0 from the 2.3.0 release
are:

   * new classhelper component thanks to a team of students from
     CS682 at U-Mass Boston. This fixes many issues with the old
     classhelper. It is implemented as a web-component and needs
     REST interface access. It will fall back to the classic
     classhelper if REST is not available or if the browser does
     not support web-components.

   * fix Windows Python installation using pip. It used to go
     into an infinite loop during install or download. Also fix
     installation of shared files (templates) so roundup-admin
     can find them.

   * using @current_user as a value in a search URL for a user
     property will use the current logged in user. Now you can
     share searches like: "My issues" as "my" will become the
     current logged in user.

   * login failures to the REST/XML-RPC interfaces are now rate
     limited to limit password guessing attacks.

   * utf8mb4 is the default charset for MySQL. This requires
     migrating your database using the mysql client. You can
     choose to keep the older character set in config.ini.

   * PostgreSQL services defined in pg_service.conf can be
     used. PostgreSQL schemas are supported to eliminate the need
     for the roundup user to have database creation/deletion
     privileges.

   * fix out of memory issue when importing larger trackers into
     PostgreSQL.

   * multiple roundup-admin improvements: display protected
     properties (like creation date), better formatting of
     output, command history. Also on windows, pyreadline3 is
     supported to provide an editable interactive command line.

   * an experimental wsgi performance improvement in 2.3.0 is now
     now the default and is opt-out.

   * new template functions: utils.readfile and
     utils.expandfile. Javascript that is included in the Python
     core will be moved to external files and be able to have
     values from Roundup substituted in the Javascript.

   * allow content-type of a template to be set from inside the
     template. This allows returning json or xml from a template
     without a .json or .xml extention.

   * fix import/export on windows to use Unix style line endings
     fixing export/import on Windows and making exports portable
     across platforms.

   * various other Windows platform fixes including test suite
     fixes.

   * sqlite version 1 and StructuredText support removed.

The file CHANGES.txt has a detailed list of feature additions and
bug fixes (67) for each release. The most recent changes from
there are at the end of this announcement. Also see the
information in doc/upgrading.txt.

If you find bugs, please report them to issues AT
roundup-tracker.org or create an account at
https://issues.roundup-tracker.org and open a new ticket. If you
have patches to fix the issues they can be attached to the email
or uploaded to the tracker.

Upgrading
=========

If you're upgrading from an older version of Roundup you must
follow the Software Upgrade guidelines given in the
doc/upgrading.txt documentation. Online at:

   https://www.roundup-tracker.org/dev_docs/docs/upgrading.html

Note that you should backup your database and run `roundup-admin
... migrate` for all your trackers to update the database schema
version. Do this before you use the web, command-line or mail
interface and before any users access the tracker.

Roundup requires Python 2 newer than version 2.7.12 or Python 3
newer than or equal to version 3.6 for correct operation. (Python
3.4 or 3.5 may work, but are not tested.) Note that Python 2
support is being removed from the CI platforms, so you should
deploy new trackers with Python 3 and plan on upgrading older
trackers from Python 2 to Python 3. See the upgrade guide.

To give Roundup a try, just download (directions above), unpack
and run:

   python demo.py

then open the url printed by the demo app.

Release info and download page:

    https://pypi.org/project/roundup/2.4.0b2/

Source and documentation is available at the website:

    https://www.roundup-tracker.org/dev_docs/

Mailing lists - the place to ask questions:

    https://sourceforge.net/p/roundup/mailman/

About Roundup
=============

Roundup is a simple-to-use and install issue-tracking system with
command-line, web and e-mail interfaces. It is based on the
winning design from Ka-Ping Yee in the Software Carpentry "Track"
design competition.

Roundup manages a number of issues (with flexible properties such
as "description", "priority", and so on) and provides the ability
to:

(a) submit new issues,
(b) find and edit existing issues, and
(c) discuss issues with other participants.

The system facilitates communication among the participants by
managing discussions and notifying interested parties when issues
are edited. One of the major design goals for Roundup that it be
simple to get going. Roundup is therefore usable "out of the box"
with any Python 3.6+ installation. It doesn't even need to be
"installed" to be operational, though an install script is
provided.

It comes with five basic issue tracker templates

* a classic bug/feature tracker
* a more extensive devel tracker for bug/features etc.
* a responsive version of the devel tracker
* a jinja2 version of the devel template (work in progress)
* a minimal skeleton

and supports four database back-ends (anydbm, sqlite, mysql and
postgresql).

Recent Changes
==============

>From 2.3.0 to 2.4.0

TBA

--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.

Hi all:

Sourceforge's mailing lists have been broken for most of the weekend.

Before I send out an announcement for 2.4.0b2 release, I want to make
sure this goes through first.

--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.

Hi David:

In message <5F3...@po...>, David
Hancock writes:
>Thank you! That all makes sense. I am using an iptables rule to
>allow 8080 from anywhere. I’d better fix that pronto.

More restrictive firewall rule for the win!

>Understood about roundup-server vs. more robust chains. For the
>moment I’m just trying to relearn schema and template changes. Those
>will get rolled into a proper Roundup, behind Apache with https and
>better firewalls.
>
>The super-convenient roundup-server is handy, but not so great if I’m
>open to attacks!

Agreed. I have been working on Roundup with some graduate student
teams this past semester.  Being able to spin up a server quickly for
development/testing out ideas has been a major win.

Have a great week.

--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.

Thank you! That all makes sense. I am using an iptables rule to allow 8080 from anywhere. I’d better fix that pronto. 

Understood about roundup-server vs. more robust chains. For the moment I’m just trying to relearn schema and template changes. Those will get rolled into a proper Roundup, behind Apache with https and better firewalls. 

The super-convenient roundup-server is handy, but not so great if I’m open to attacks!

Cheers!
--
David Hancock (sent from my phone)

On May 18, 2024, at 18:19, John P. Rouillard <ro...@cs...> wrote:

Hi David:

In message <F6E...@po...>,
David Hancock writes:
> Roundup 2.3.0 source distribution, Python 3.10.12, running
> roundup-server with http on port 8080, net 0.0.0.0. I have
> SENDMAILDEBUG writing to a local file.

Are you running a firewall on your host and is your host connected to
the public internet?

> I’d like to understand the errors that follow. Here’s the server
> running in the foreground, followed by a request from my IP for the
> list of issues, followed by two pairs of error messages from IP
> addresses that I don’t recognize.

Details below, but this looks like you are being scanned/probed.

> Any ideas what these are (or pointers for finding this myself)? Here
> is what I’m seeing:
> 
> (simona-roundup) dhancock@ubuntu-s-1vcpu-1gb-nyc3-01:~/trackers/simona$ roundup-server -p 8080 -n 0.0.0.0 simona=/home/dhancock/trackers/simona
> 
> Roundup server started on 0.0.0.0:8080
> 
> 100.16.88.22 - - [18/May/2024 21:00:25] "GET /simona/issue?@sort=-activity&@group=priority&@filter=status&@columns=id%2Cactivity%2Ctitle%2Ccreator%2Cassignedto%2Cstatus&@search_text=&status=-1%2C1%2C2%2C3%2C4%2C5%2C6%2C7&@dispname=Show%20All&@pagesize=50&@startwith=0 HTTP/1.1" 200 -
> 
> 149.56.23.153 - - [18/May/2024 21:00:30] code 400, message Bad request syntax ('\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01ü\\x03\\x03\\x94OW')
> 
> 149.56.23.153 - - [18/May/2024 21:00:30] "\x16\x03\x01\x02\x00\x01\x00\x01ü\x03\x03\x94OW" 400 -

I am running a dev version of Roundup on http. If I hit the endpoint
using HTTPS not HTTP, I see:

192.168.1.20 - - [18/May/2024 17:45:02] code 400, message Bad request version ("y$¯OÞU\\x00F\\x13\\x02\\x13\\x03\\x13\\x01À,À0̨̩À\\xadÀ+À/À¬À#À'À")
192.168.1.20 - - [18/May/2024 17:45:02] "\x16\x03\x01\x02\x00\x01\x00\x01ü\x03\x03A\x93#6ª..." 400 -

(... is elided) which looks a lot like your output.

See also: https://stackoverflow.com/questions/60144556/apache-httpd-server-doesnt-accept-get-http-request-from-f5-load-balancer

> 
> 87.121.69.52 - - [18/May/2024 21:02:09] code 501, message Unsupported method ('CONNECT')
> 
> 87.121.69.52 - - [18/May/2024 21:02:09] "CONNECT google.com:443 HTTP/1.1" 501 -

This is a connect/tunnel request from some system/scanner on the
internet. https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods/CONNECT

It looks like your test box is on the open internet and is being hit
by random scanners/hackers.  My suggestion is to enable a host
firewall and block all IP connections to port 8080 that are not from
the hosts you are using to test the server (network 100.16.88/24
maybe). If your server and test client are on a local lan, use '-n
<server local lan address>' and configure config.ini to use the local
lan address.

Roundup-server is fine for production, but it doesn't have the
features/performance required to defend against an attack. If you are
allowing access from the internet, we recommend placing roundup-server
behind a reverse proxy. Reverse proxies (e.g. Apache, varnish, nginx,
Hiawatha ...) can run web application firewalls (WAF), rate limit or
filter connections. Roundup-server takes longer to process/drop a
connection and doesn't have WAF and other filtering capabilities.

Using roundup-server directly on a local lan/intranet protected from
the internet by a firewall is fine as you don't expect people to
actively attack the server to be on your local lan.

> This seems to happen only on the first request after starting the
> roundup server, and then they stop. And I’ve just observed that after
> subsequent restarts, they don’t appear for a few real requests, then
> I get a few more of the code 400s.

Timing of the connections could be a scanning/hacking tool that hits
an endpoint until it gets an answer. Then slows or stops probes. Your
'first request' observation could be regular probing of your system
that is discarded because nothing is listening. Then when you fire up
Roundup, well it's listening and you see the probe that was invisible
before.

Most hosts have host level firewalls. You might see more activity of
probing by looking at your firewall logs.

Hope this helps.
--
               -- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.

Hi David:

In message <F6E...@po...>,
David Hancock writes:
>Roundup 2.3.0 source distribution, Python 3.10.12, running
>roundup-server with http on port 8080, net 0.0.0.0. I have
>SENDMAILDEBUG writing to a local file.

Are you running a firewall on your host and is your host connected to
the public internet?

>I’d like to understand the errors that follow. Here’s the server
>running in the foreground, followed by a request from my IP for the
>list of issues, followed by two pairs of error messages from IP
>addresses that I don’t recognize.

Details below, but this looks like you are being scanned/probed.

>Any ideas what these are (or pointers for finding this myself)? Here
>is what I’m seeing:
>
>(simona-roundup) dhancock@ubuntu-s-1vcpu-1gb-nyc3-01:~/trackers/simona$ roundup-server -p 8080 -n 0.0.0.0 simona=/home/dhancock/trackers/simona
>
>Roundup server started on 0.0.0.0:8080
>
>100.16.88.22 - - [18/May/2024 21:00:25] "GET /simona/issue?@sort=-activity&@group=priority&@filter=status&@columns=id%2Cactivity%2Ctitle%2Ccreator%2Cassignedto%2Cstatus&@search_text=&status=-1%2C1%2C2%2C3%2C4%2C5%2C6%2C7&@dispname=Show%20All&@pagesize=50&@startwith=0 HTTP/1.1" 200 -
>
>149.56.23.153 - - [18/May/2024 21:00:30] code 400, message Bad request syntax ('\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01ü\\x03\\x03\\x94OW')
>
>149.56.23.153 - - [18/May/2024 21:00:30] "\x16\x03\x01\x02\x00\x01\x00\x01ü\x03\x03\x94OW" 400 -

I am running a dev version of Roundup on http. If I hit the endpoint
using HTTPS not HTTP, I see:

 192.168.1.20 - - [18/May/2024 17:45:02] code 400, message Bad request version ("y$¯OÞU\\x00F\\x13\\x02\\x13\\x03\\x13\\x01À,À0̨̩À\\xadÀ+À/À¬À#À'À")
 192.168.1.20 - - [18/May/2024 17:45:02] "\x16\x03\x01\x02\x00\x01\x00\x01ü\x03\x03A\x93#6ª..." 400 -

(... is elided) which looks a lot like your output.

See also: https://stackoverflow.com/questions/60144556/apache-httpd-server-doesnt-accept-get-http-request-from-f5-load-balancer

>
>87.121.69.52 - - [18/May/2024 21:02:09] code 501, message Unsupported method ('CONNECT')
>
>87.121.69.52 - - [18/May/2024 21:02:09] "CONNECT google.com:443 HTTP/1.1" 501 -

This is a connect/tunnel request from some system/scanner on the
internet. https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods/CONNECT

It looks like your test box is on the open internet and is being hit
by random scanners/hackers.  My suggestion is to enable a host
firewall and block all IP connections to port 8080 that are not from
the hosts you are using to test the server (network 100.16.88/24
maybe). If your server and test client are on a local lan, use '-n
<server local lan address>' and configure config.ini to use the local
lan address.

Roundup-server is fine for production, but it doesn't have the
features/performance required to defend against an attack. If you are
allowing access from the internet, we recommend placing roundup-server
behind a reverse proxy. Reverse proxies (e.g. Apache, varnish, nginx,
Hiawatha ...) can run web application firewalls (WAF), rate limit or
filter connections. Roundup-server takes longer to process/drop a
connection and doesn't have WAF and other filtering capabilities.

Using roundup-server directly on a local lan/intranet protected from
the internet by a firewall is fine as you don't expect people to
actively attack the server to be on your local lan.

>This seems to happen only on the first request after starting the
>roundup server, and then they stop. And I’ve just observed that after
>subsequent restarts, they don’t appear for a few real requests, then
>I get a few more of the code 400s.

Timing of the connections could be a scanning/hacking tool that hits
an endpoint until it gets an answer. Then slows or stops probes. Your
'first request' observation could be regular probing of your system
that is discarded because nothing is listening. Then when you fire up
Roundup, well it's listening and you see the probe that was invisible
before.

Most hosts have host level firewalls. You might see more activity of
probing by looking at your firewall logs.

Hope this helps.
--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.

Roundup 2.3.0 source distribution, Python 3.10.12, running roundup-server with http on port 8080, net 0.0.0.0. I have SENDMAILDEBUG writing to a local file.

Background: I haven’t done any Roundup work for at least 6 years; that server is Python 2.7 and a much older Roundup. I’m prototyping some additions (a new issue type), and I’m running a standalone server for the moment. 

I’d like to understand the errors that follow. Here’s the server running in the foreground, followed by a request from my IP for the list of issues, followed by two pairs of error messages from IP addresses that I don’t recognize. This seems to happen only on the first request after starting the roundup server, and then they stop. And I’ve just observed that after subsequent restarts, they don’t appear for a few real requests, then I get a few more of the code 400s.

Any ideas what these are (or pointers for finding this myself)? Here is what I’m seeing:

(simona-roundup) dhancock@ubuntu-s-1vcpu-1gb-nyc3-01:~/trackers/simona$ roundup-server -p 8080 -n 0.0.0.0 simona=/home/dhancock/trackers/simona

Roundup server started on 0.0.0.0:8080

100.16.88.22 - - [18/May/2024 21:00:25] "GET /simona/issue?@sort=-activity&@group=priority&@filter=status&@columns=id%2Cactivity%2Ctitle%2Ccreator%2Cassignedto%2Cstatus&@search_text=&status=-1%2C1%2C2%2C3%2C4%2C5%2C6%2C7&@dispname=Show%20All&@pagesize=50&@startwith=0 HTTP/1.1" 200 -

149.56.23.153 - - [18/May/2024 21:00:30] code 400, message Bad request syntax ('\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01ü\\x03\\x03\\x94OW')

149.56.23.153 - - [18/May/2024 21:00:30] "\x16\x03\x01\x02\x00\x01\x00\x01ü\x03\x03\x94OW" 400 -

87.121.69.52 - - [18/May/2024 21:02:09] code 501, message Unsupported method ('CONNECT')

87.121.69.52 - - [18/May/2024 21:02:09] "CONNECT google.com:443 HTTP/1.1" 501 -

Thank you for any help you can provide.

P.S. I was also going to report that the Roundup Wiki was down, but it’s back now.

Cheers!
-- 
David Hancock

Hi everybody:

In preparation for release 2.4 I have spent some time fixing tests
(and code) on the windows platform.

If you run Roundup on windows, can you download the following zip file,

  https://github.com/roundup-tracker/roundup/archive/f6d473d27689ddcaf68bf1a2801045834ea3c8d9.zip

unpack it and run:

  python -m pytest test

and let me know if you pas everything or fail any tests. This tests
just the basics using stdlib with pytest (and optionally requests).  I
don't have MySQL/PostgreSQL/xapian/.. installed on the windows box I
have access to so only the basic out of the box stuff works.

(Note: I am sharing GitHub's download URL because Sourceforge's links
for downloading snapshots become invalid after a time.)

Thanks.

--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.

Hi Stefan/Ralf:

I must have missed this email originally (hmm, given the timestamp I
may not have received it yet). I read it on the ML archive.

In message <202...@ru...>,
Ralf Schlatterbeck writes:
>On Mon, Apr 29, 2024 at 11:31:43AM +0000, Schmelz, Stefan wrote:
>[...]
>> And this ist he HTML response in My browser:
>> Error response
>> Error code: 404
>> Message: /issue2/?@ok_message=Der%20Eintrag%20%22msg3%22%20wurde%20erstellt%0ADer%20Eintrag%20%22issue2%22%20wurde%20erstellt&@template=item.
>> Error code explanation: 404 - Nothing matches the given URI.

I'm sorry you are running into problems. This is an odd one.

>Are you running this with the standalone server or behind a web server
>like apache or nginx?

That is my first question as well. If the URL is really:

   .../issue2/?...

that's wrong. It should be:

  .../issue2?...

(note no '/' before the query part). I can confirm that:

    https://myhost/demo/issue157

displays issue 157 while:

    https://myhost/demo/issue157/

reports a 404. So I can reproduce your results, but not your cause.

>Let us know if you make progress on this!

I agree. It looks like something is messing up the URL.

URL's that point to files (e.g. /file23) use a trailing '/' and
optional name component to trigger a download of the file
contents. E.G. /file23/myfile would download the contents of file23
and suggest the name "myfile" in the file save dialog. '/file23/'
would start the download with the file name "download" suggested in the
dialog.

However other object types don't support the trailing '/' in the URL
and return 404. If Roundup is really returning the trailing /, it's a
bug that I have never seen. To help us help you can you supply:

  Version of Roundup (roundup-admin -v)

  Version of Python (python -V)

  Operating system

  How you installed Roundup ('pip install roundup', download the
      tarball/release and ran setup.py ...)

  How you are accessing Roundup. Via roundup-server? WSGI with
      gunicorn etc. Is there a cache server or reverse proxy involved?

Thanks and sorry your having a tough time here.

--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.

Hi Stefan,

On Mon, Apr 29, 2024 at 11:31:43AM +0000, Schmelz, Stefan wrote:
[...]
> And this ist he HTML response in My browser:
> Error response
> Error code: 404
> Message: /issue2/?@ok_message=Der%20Eintrag%20%22msg3%22%20wurde%20erstellt%0ADer%20Eintrag%20%22issue2%22%20wurde%20erstellt&@template=item.
> Error code explanation: 404 - Nothing matches the given URI.

Are you running this with the standalone server or behind a web server
like apache or nginx?

What have you configured in config.ini in section [tracker], config
variable 'web'? This must match exactly what you have configured in the
web server or what you have specified on the command-line of
roundup-server. The argument passed to roundup-server is the name of the
first URL component after the hostname -- that would go *before* the
"/issue2" in your Message above. This must match what you've configured
in 'web'.

So as 'web' you would have something like
web = http://hostname/trackername/
and you would call roundup-server with
roundup-server trackername=/path/to/tracker/

Note that the 'web' config variable needs a trailing '/'.

Let us know if you make progress on this!

Thanks
Ralf
-- 
Dr. Ralf Schlatterbeck                  Tel:   +43/2243/26465-16
Open Source Consulting                  www:   www.runtux.com
Reichergasse 131, A-3411 Weidling       email: of...@ru...

Hi There,
I just installed roundup as a test and i have to report that it does not work that well so far.
If I create, or update anything, there is a success message and that yields a 404 Error every time.

This ist he Server Log if I create a new Issue that is assigned to me:
192.168.24.182 - - [29/Apr/2024 11:25:40] "GET /issue2/?@ok_message=Der%20Eintrag%20%22msg3%22%20wurde%20erstellt%0ADer%20Eintrag%20%22issue2%22%20wurde%20erstellt&@template=item HTTP/1.1" 404 -

And this ist he HTML response in My browser:
Error response
Error code: 404
Message: /issue2/?@ok_message=Der%20Eintrag%20%22msg3%22%20wurde%20erstellt%0ADer%20Eintrag%20%22issue2%22%20wurde%20erstellt&@template=item.
Error code explanation: 404 - Nothing matches the given URI.

I don't know what to do and what could cause it. I did some digging in the config, but that was inconclusive and the mailing list so far did not yield any useful answers either...

Pls Help, I#m starting to feel retarded.
Regards
Stefan


--
Solupharm Pharmazeutische Erzeugnisse GmbH
Industriestra?e 3, D-34212 Melsungen
Tel: +49 (5661) 7305-767
Email: Ste...@so...
Homepage: https://www.solupharm.com


[lslp_ogo] [Vision_mission]


Folgen Sie uns auf Facebook! [https://mail.solupharm.com/owa/auth/15.1.2375/themes/resources/facebook.png] <https://www.facebook.com/Solupharm-Pharmazeutische-Erzeugnisse-GmbH-100921692587632/>

-----------------------------------------------------------------------------------------------
Gesch?ftsf?hrer: Friedemann Seitz, Thomas Zimmermann, Dr. J?rgen G?b
Sitz der Gesellschaft: D-34212 Melsungen
HRB 11245, Amtsgericht Fritzlar, USt-ID DE-203368511
-----------------------------------------------------------------------------------------------

Hi Everybody:

MySQL has had a checkered past with supporting UTF8 charsets.  Roundup
has shared that challenge. The utf8mb4 preferred by Roundup since
2022, has some issues. This includes the crashes reported by Nagy
Gabor when Roundup mixes utf8mb4 charsets with incompatible
collations. This latest patch hopefully fixes all of those and chooses
the best defaults while letting you fall back to older charsets.

It also include instructions on converting the underlying database
from whatever encoding/collation to a
utf8mb4/utf8_unicode_ci/utf8_0900_bin combination.

I have done some minimal testing, but nothing I can do would match a
conversion on a real live tracker.

So I am asking those of you with trackers running on MySQL to look at
the commit including documentation at:

  https://sourceforge.net/p/roundup/code/ci/8b31893f5930cbea37031d49bd08a631d1b6b654/

and test this. It will be part of the 2.4.0 release in July. I plan on
putting out a beta release (installable by pip) in mid May, but having
this tested before then would really help.

Thanks and have a great week.

--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.