summaryrefslogtreecommitdiff
path: root/pgweb/security
AgeCommit message (Collapse)Author
2022-03-23Fix unsupported version warning on security pageJonathan S. Katz
This has probably not worked since 0cb56d93, but this patch will allow for the warning to appear.
2021-05-24Add missing model changeMagnus Hagander
2021-05-24Remove cve_visible field on security patchesMagnus Hagander
Since we are not relying on external services for linking to security patch information anymore, instead providing our own pages, this is no longer used for anything. So get rid of it along with the cronjob to update it.
2021-04-09Exclude security notices with no CVE from list of CVEs in sitemapMagnus Hagander
Otherwise we're instructing google and others to index pages that don't exist.
2021-03-28Order versions in descending order in CVE listJonathan S. Katz
Across other parts of pgweb we display things from newest to oldest version, so this brings the CVE display to match this convention.
2021-03-28Add page with additional details about a CVEJonathan S. Katz
This page contains most information that may be found on 3rd party sites about a particular CVE, but with the benefit of being hosted on the PostgreSQL infrastructure. This does require inserting the CVE description into the website, which will include backporting the CVE descriptions throughout many existing CVEs, but the added benefit is that this information is available when we publish a release, vs. waiting for a 3rd party to publish the info. This patch also adds sitemap indexing for each of the CVE entries, and ensures the top-level CVE URL is in the sitemap.
2021-03-27Refactor generation of CVE number from CVE IDJonathan S. Katz
This allows the method to be repurposed in additional parts of the pgweb codebase.
2021-03-27Update CVE ID syntax validatorJonathan S. Katz
The current validator stopped after 5 digits, whereas there can be an aribtrary amount. However, the MITRE docs appear to stop at 7, so this seems like a sane cut-off, until it's not[1]. [1] https://cve.mitre.org/cve/identifiers/syntaxchange.html#new
2020-08-25Fix cvss links in admin interfaceMagnus Hagander
2020-07-04Fix up some incorrect importsMagnus Hagander
2020-07-03Load signal handlers from an app instead of urllistMagnus Hagander
This is the place to load them to make sure they always load. This means we can also now remove a hardcoded special varnish purging in the CVE crawler script, because all saves including those from cron jobs will now fire the signals and thus the automatic varnish purges.
2020-05-14RedHat have started requiring both a html and a json to display CVEsMagnus Hagander
And dumb as it is they return "200 OK" on the CVE *page* even if the CVE doesn't exist. So we have to poll both the page and the API call in order to figure out if it's actually there.
2020-03-31Set on_delete=models.CASCADE on all ForeignKey fieldsMagnus Hagander
This is the bardware compatible value that will be needed once we upgrade django later.
2020-01-09Fix a number of incorrect escapesMagnus Hagander
Pointed out by newer versions of pep8, but they were never correct.
2019-02-10Update migrations for py3Magnus Hagander
A lot of strings in the migrations needed a change from b' to ' to work after the migration to py3, but this was forgotten in the big patch. No actual changes included in this patch. A lot of strings in the migrations needed a change from b' to ' to work after the migration to py3, but this was forgotten in the big patch.
2019-01-26More generic changes from 2to3Magnus Hagander
2019-01-26Generic unicode updatesMagnus Hagander
2019-01-26Update syntax for relative importsMagnus Hagander
2019-01-26Update to new style exception catchingMagnus Hagander
2019-01-17Fix deprecated comparison structsMagnus Hagander
2019-01-17Fix whitespace and indentation, per pep8Magnus Hagander
2019-01-17Tabs, meet your new overlords: spacesMagnus Hagander
In a quest to reach pep8, use spaces to indent rather than tabs.
2018-06-29Remove unused variable referencesMagnus Hagander
2018-06-29Remove unused importsMagnus Hagander
2018-03-10Replace NavContext and render_to_response with render_pgwebMagnus Hagander
render_to_response does not work on newer django, so it needs to be replaced. And using a speicfic context actually overcomplicates things, it's easier to just use a wrapper function. For those cases where we don't need NavContext, just use render() (the new shortcut function from django), which also removes the need to use RequestContext.
2018-02-25Allow unlinked CVEs and poll for valid linksMagnus Hagander
This way new CVEs that are added will start off being listed, but not with a link. When upstream (currently redhat) publishes the CVE, a cronjob will pick this up and update it with a link. Of course, we still only show CVEs that are listed as public, but this should hopefully get rid of some of the questions of why we link to a 404.
2018-02-08Fix ordering of CVE entriesMagnus Hagander
2018-01-26Don't list unsupported versions that have no patches at allMagnus Hagander
That just generates a completely empty page in the output, so remove the link completely instead. For supported versions we list all of them, including if they have no patches.
2018-01-26Remove dead codeMagnus Hagander
2018-01-26Fix query for version-specific security support listMagnus Hagander
When asking for version x, we should still list all versions the patch in question applies to, not limit it to the current one.
2018-01-26Small refectoringMagnus Hagander
Makes the code easier to use in future feed support
2018-01-25Remove references to vector_otherMagnus Hagander
The actual field was already removed, but references in admin.py were accidentally left around. Oops.
2018-01-25Database:ify the list of security patchesMagnus Hagander
This finally moves the patches into the db, which makes it a lot easier to filter patches in the views. It also adds the new way of categorising patches, which is assigning them a CVSSv3 score. For now, there are no public views to this, and the old static pages remain. This is so we can backfill all existing security patches before we make it public.
generated by cgit v1.2.3 (git 2.39.1) at 2025-07-21 14:21:44 +0000