[Fwd: Fedora wiki login issues]
by Ignacio Vazquez-Abrams
For your consideration.
-------- Forwarded Message --------
> From: Tim Abbott <tabbott(a)MIT.EDU>
> To: webmaster(a)fedoraproject.org
> Subject: Fedora wiki login issues
> Date: Tue, 25 Nov 2008 12:27:18 -0500 (EST)
>
> Hello,
>
> I just registered for an account (username: tabbott) with the Fedora
> Account System, but the Fedora Wiki refuses to let me login, giving "Login
> error: Incorrect password entered. Please try again.". I am quite
> confident that I am providing the same password to the Fedora Wiki and the
> Fedora Account System (with which I have tested logging out and in again);
> is there some sort of delay for information to propagate to the Fedora
> Wiki?
>
> -Tim Abbott
--
Ignacio Vazquez-Abrams <ivazqueznet(a)gmail.com>
14 years, 10 months
Re: Fixing CSRF exploits in Infrastructure
by John (J5) Palmieri
I've read the document and it is pretty well thought out. A couple of comments - for the JavaScript parts wouldn't that be better to setup as an included file which also pulls in a JS library? Just so people aren't copying and pasting? That way you will also be able to extend the functionality if need be and app developers would have to worry about one line of code instead of 10.
As for myfedora this is pretty straight forward as we can use the middleware layer to inject the javascript variables and do the hashing and double authentication. Most of our modification requests will be going over json so a javascript layer would work there too. We can then simply have our proxies pass the hash onto the ProxyClients. It is still a chain of trust where you trust our servers have implemented the protocol correctly and we aren't just hashing the cookie when it has to pass it to the proxy client.
The only way to fix the man in the middle trust issue would be to have the client somehow sign the session hash, but even then, the client would have to register a public key on a server you trust.
----- "Toshio Kuratomi" <a.badger(a)gmail.com> wrote:
> Greetings all,
>
> I've been researching the CSRF exploit and how it affects our web
> apps
> recently. The short story is that our code is pretty open to this at
> the moment. I've written up a proposal for fixing this but it will
> require a lot of coding so I'd love to have some more eyes on it to
> make
> sure I'm not making any stupid mistakes.
>
> The proposal is here::
> https://fedorahosted.org/fas/wiki/CSRF
>
> The ticket for the overall CSRF fixing is here::
> https://fedorahosted.org/fedora-infrastructure/ticket/992
>
> I consider fixing this to be a fairly high priority so I'll be
> starting
> work on implementing this for a few pkgdb methods very soon.
> Assuming
> the technique works we'll need to port every method that can change
> data
> in every app to use this.
>
> -Toshio
>
>
> _______________________________________________
> Fedora-infrastructure-list mailing list
> Fedora-infrastructure-list(a)redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-infrastructure-list
--
--
John (J5) Palmieri
Software Engineer
Red Hat, Inc.
14 years, 10 months
Change request
by Mike McGrath
I need to add the following:
AddType image/svg+xml .svg
AddType image/svg+xml .svgz
AddEncoding gzip .svgz
<FilesMatch \.svgz$>
<IfModule mod_gzip.c>
mod_gzip_on No
</IfModule>
</FilesMatch>
Into a general config file for our app servers. At present it is in our
wiki config. This is causing problems for some of our docs sites that use
svg that are not on a machine that are on the wiki.
-Mike
14 years, 10 months
release day change request
by Mike McGrath
Ugh, well poop. proxy3 was built with the wrong arch and we didn't
realize it until today. We've taken it out of rotation. I'd like to:
1) rebuild proxy3 as i686
2) leave it out of rotation unless we need it.
can I get 2 +1's?
In theory it can add 25% capacity to how many requests we can serve in a
given time. We may not need it.
-Mike
14 years, 10 months
proper way to update /var/lib/puppet/application/mirrors/releases.txt
by Jesse Keating
This looks like it is its own git repo, but apparently you need to be in
the sysadmin-web group to edit this. I'm not in the group, so in order
for me to manage this we either need to add me to the group (yuck, more
groups) or move this to a different ownership set, or something else.
Either way a couple things need to be done to the file.
1) removing F10 Preview and Beta
2) adding F10 itself.
These will need to be done by the release tomorrow.
--
Jesse Keating
Fedora -- Freedom² is a feature!
identi.ca: http://identi.ca/jkeating
14 years, 10 months
Congratulations to Nigel Jones
by Mike McGrath
I'm happy to announce I've just approved Nigel Jones in to the
sysadmin-main group. He's the first new member we've had to that group
since Ricky Zhou was approved in May earlier this year.
For those that don't know sysadmin-main is for our core dedicated admins.
It typically takes many months (sometimes years) of commitment to get in
to this group. Nigel is on his way to doing a great job with re-inventing
our monitoring environment. He's spent a lot of time on many of our bits
of infrastructure and regularly puts in many hours a week doing Fedora
related tasks. He's a great volunteer and we're happy and lucky to have
him on.
Nigel is currently based out of Brisbane which makes him the first non-US
member to be in sysadmin-main. This is an important change in focus for
us and greatly helps the stability/coverage of our environment.
Thanks Nigel!
-Mike
14 years, 10 months
Re: Change Request - Update Website Languages
by Nigel Jones
+1, I find it a bit disappointing that French & Dutch is getting removed, but if we can't help it, we can't help it.
Also, I'd point out that the SOP says that standard release procedures don't need to be voted on/announced (unless I misread it)
- Nigel
----- Original Message -----
From: "Ricky Zhou" <ricky(a)fedoraproject.org>
To: fedora-infrastructure-list(a)redhat.com
Sent: Tuesday, November 25, 2008 9:47:19 PM GMT +10:00 Brisbane
Subject: Change Request - Update Website Languages
Hi, I need to update all of the language.conf files for the final set of
languages for the F10 website. This is necessary for the release, so
can I get two +1s?
The config patch is available at
http://ricky.fedorapeople.org/0001-Update-all-website-languages.patch
Thanks,
Ricky
_______________________________________________
Fedora-infrastructure-list mailing list
Fedora-infrastructure-list(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-infrastructure-list
14 years, 10 months
Informal survey
by Mike McGrath
Hey guys, completely voluntary but I thought I'd ask because I'm curious
For personal use, how many of you use something like linode or slicehost
or an individual provider?
If you do use a provider which one is it?
For me, I do use one and I use slicehost.
-Mike
14 years, 10 months
Bodhi 10k bug
by Luke Macken
As some of you may have noticed, the last batch of updates contained 209
updates with the ID of 'FEDORA-2008-10000'. This is is due to a flaw in the
way bodhi's PackageUpdate.assign_id() method finds the current update with the
highest id. Presently, it does a PackageUpdate.select(...,
orderBy=PackageUpdate.q.updateid). Since PackageUpdate.updateid is a unicode
column, and due to the fact that u'FEDORA-2008-10000' < u'FEDORA-2008-9999',
this started to fail miserably.
Attached is a patch that has the assign_id method order the query by the
date_pushed DateTimeCol in order to find the highest updateid. However, it
seems that SQLObject completely ignore milliseconds:
if datetime:
def DateTimeConverter(value, db):
return "'%04d-%02d-%02d %02d:%02d:%02d'" % (
value.year, value.month, value.day,
value.hour, value.minute,
value.second)
The problem with this is that we must now take into account multiple updates
that were pushed at the same second.
The "proper" way to fix this is at the model level, and probably to use an
integer for the updateid column. I'm in the process of finishing up the
SQLAlchemy port, which will properly solve this problem. In the mean time,
this hack will not require any database changes.
This patch also includes a test case for this 10k bug.
[lmacken@x300 bodhi]$ nosetests
bodhi/tests/test_model.py:TestPackageUpdate.test_id
.
----------------------------------------------------------------------
Ran 1 test in 0.084s
OK
Once approved and applied, I will push out a fixed package (to releng2 only),
fix the existing updates from the last push, and send out an errata containing
the new update IDs.
+1's ?
luke
14 years, 10 months