release: merge back stable branch into default

docs/release-notes/release-notes-4.12.1.rst

@@ -0,0 +1,48 b''
+|RCE| 4.12.1 |RNS|
+------------------
+
+Release Date
+^^^^^^^^^^^^
+
+- 2018-05-15
+
+
+New Features
+^^^^^^^^^^^^
+
+
+
+General
+^^^^^^^
+
+- SVN: execute web-based hooks for SVN so integration framework work also via
+  web based editor.
+- ReCaptcha: adjust for v2 that is the only left one supported since 1st of May.
+- JIRA integration: add support for proxy server connection to JIRA server.
+
+
+Security
+^^^^^^^^
+
+
+
+Performance
+^^^^^^^^^^^
+
+
+
+Fixes
+^^^^^
+
+- SVN: make hooks safer and fully backward compatible. In certain old setups
+  new integration for SVN could make problems. We use a safer hooks now that
+  shouldn't break usage of older SVN and still provide required functionality
+  for integration framework
+- LDAP: use connection ping only in case of single server.
+- Repository feed: fix path-based permissions condition on caching element.
+
+
+Upgrade notes
+^^^^^^^^^^^^^
+
+- Scheduled release addressing found problems reported by users.

.hgtags

@@ -36,3 +36,4 b' 194c74f33e32bbae6fc4d71ec5a999cff3c13605'
 8fbd8b0c3ddc2fa4ac9e4ca16942a03eb593df2d v4.11.5
 f0609aa5d5d05a1ca2f97c3995542236131c9d8a v4.11.6
 b5b30547d90d2e088472a70c84878f429ffbf40d v4.12.0
+9072253aa8894d20c00b4a43dc61c2168c1eff94 v4.12.1

docs/release-notes/release-notes.rst

@@ -9,6 +9,7 b' Release Notes'
 .. toctree::
    :maxdepth: 1
 
+   release-notes-4.12.1.rst
    release-notes-4.12.0.rst
    release-notes-4.11.6.rst
    release-notes-4.11.5.rst

rhodecode/apps/repository/views/repo_feed.py

@@ -152,13 +152,14 b' class RepoFeedView(RepoAppView):'
             return _generate_feed()
 
         if self.path_filter.is_enabled:
+            mime_type, feed = _generate_feed()
+        else:
             invalidator_context = CacheKey.repo_context_cache(
-                _generate_feed_and_cache, self.db_repo_name, CacheKey.CACHE_TYPE_ATOM)
+                _generate_feed_and_cache, self.db_repo_name,
+                CacheKey.CACHE_TYPE_ATOM)
             with invalidator_context as context:
                 context.invalidate()
                 mime_type, feed = context.compute()
-        else:
-            mime_type, feed = _generate_feed()
 
         response = Response(feed)
         response.content_type = mime_type
@@ -204,14 +205,15 b' class RepoFeedView(RepoAppView):'
             return _generate_feed()
 
         if self.path_filter.is_enabled:
+            mime_type, feed = _generate_feed()
+        else:
             invalidator_context = CacheKey.repo_context_cache(
-                _generate_feed_and_cache, self.db_repo_name, CacheKey.CACHE_TYPE_RSS)
+                _generate_feed_and_cache, self.db_repo_name,
+                CacheKey.CACHE_TYPE_RSS)
 
             with invalidator_context as context:
                 context.invalidate()
                 mime_type, feed = context.compute()
-        else:
-            mime_type, feed = _generate_feed()
 
         response = Response(feed)
         response.content_type = mime_type

rhodecode/authentication/base.py

@@ -21,7 +21,8 b''
 """
 Authentication modules
 """
-
+import socket
+import string
 import colander
 import copy
 import logging
@@ -31,14 +32,13 b' import warnings'
 import functools
 
 from pyramid.threadlocal import get_current_registry
-from zope.cachedescriptors.property import Lazy as LazyProperty
 
 from rhodecode.authentication.interface import IAuthnPluginRegistry
 from rhodecode.authentication.schema import AuthnPluginSettingsSchemaBase
 from rhodecode.lib import caches
 from rhodecode.lib.auth import PasswordGenerator, _RhodeCodeCryptoBCrypt
-from rhodecode.lib.utils2 import safe_int
-from rhodecode.lib.utils2 import safe_str
+from rhodecode.lib.utils2 import safe_int, safe_str
+from rhodecode.lib.exceptions import LdapConnectionError
 from rhodecode.model.db import User
 from rhodecode.model.meta import Session
 from rhodecode.model.settings import SettingsModel
@@ -556,6 +556,63 b' class RhodeCodeExternalAuthPlugin(RhodeC'
         return auth
 
 
+class AuthLdapBase(object):
+
+    @classmethod
+    def _build_servers(cls, ldap_server_type, ldap_server, port):
+        def host_resolver(host, port, full_resolve=True):
+            """
+            Main work for this function is to prevent ldap connection issues,
+            and detect them early using a "greenified" sockets
+            """
+            host = host.strip()
+            if not full_resolve:
+                return '{}:{}'.format(host, port)
+
+            log.debug('LDAP: Resolving IP for LDAP host %s', host)
+            try:
+                ip = socket.gethostbyname(host)
+                log.debug('Got LDAP server %s ip %s', host, ip)
+            except Exception:
+                raise LdapConnectionError(
+                    'Failed to resolve host: `{}`'.format(host))
+
+            log.debug('LDAP: Checking if IP %s is accessible', ip)
+            s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+            try:
+                s.connect((ip, int(port)))
+                s.shutdown(socket.SHUT_RD)
+            except Exception:
+                raise LdapConnectionError(
+                    'Failed to connect to host: `{}:{}`'.format(host, port))
+
+            return '{}:{}'.format(host, port)
+
+        if len(ldap_server) == 1:
+            # in case of single server use resolver to detect potential
+            # connection issues
+            full_resolve = True
+        else:
+            full_resolve = False
+
+        return ', '.join(
+            ["{}://{}".format(
+                ldap_server_type,
+                host_resolver(host, port, full_resolve=full_resolve))
+             for host in ldap_server])
+
+    @classmethod
+    def _get_server_list(cls, servers):
+        return map(string.strip, servers.split(','))
+
+    @classmethod
+    def get_uid(cls, username, server_addresses):
+        uid = username
+        for server_addr in server_addresses:
+            uid = chop_at(username, "@%s" % server_addr)
+        return uid
+
+
 def loadplugin(plugin_id):
     """
     Loads and returns an instantiated authentication plugin.
@@ -613,7 +670,7 b' def authenticate(username, password, env'
     authn_registry = get_authn_registry(registry)
     plugins_to_check = authn_registry.get_plugins_for_authentication()
     log.debug('Starting ordered authentication chain using %s plugins',
-              plugins_to_check)
+              [x.name for x in plugins_to_check])
     for plugin in plugins_to_check:
         plugin.set_auth_type(auth_type)
         plugin.set_calling_scope_repo(acl_repo_name)

rhodecode/authentication/plugins/__init__.py

@@ -0,0 +1,19 b''
+# -*- coding: utf-8 -*-
+
+# Copyright (C) 2012-2018 RhodeCode GmbH
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License, version 3
+# (only), as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+# This program is dual-licensed. If you wish to learn more about the
+# RhodeCode Enterprise Edition, including its added features, Support services,
+# and proprietary license terms, please see https://rhodecode.com/licenses/

rhodecode/authentication/plugins/auth_ldap.py

@@ -22,16 +22,13 b''
 RhodeCode authentication plugin for LDAP
 """
 
-import socket
-import re
-import colander
 import logging
 import traceback
-import string
 
+import colander
 from rhodecode.translation import _
 from rhodecode.authentication.base import (
-    RhodeCodeExternalAuthPlugin, chop_at, hybrid_property)
+    RhodeCodeExternalAuthPlugin, AuthLdapBase, hybrid_property)
 from rhodecode.authentication.schema import AuthnPluginSettingsSchemaBase
 from rhodecode.authentication.routes import AuthnPluginResourceBase
 from rhodecode.lib.colander_utils import strip_whitespace
@@ -200,40 +197,7 b' class LdapSettingsSchema(AuthnPluginSett'
         widget='string')
 
 
-class AuthLdap(object):
-
-    def _build_servers(self):
-        def host_resolver(host, port):
-            """
-            Main work for this function is to prevent ldap connection issues,
-            and detect them early using a "greenified" sockets
-            """
-            host = host.strip()
-
-            log.info('Resolving LDAP host %s', host)
-            try:
-                ip = socket.gethostbyname(host)
-                log.info('Got LDAP server %s ip %s', host, ip)
-            except Exception:
-                raise LdapConnectionError(
-                    'Failed to resolve host: `{}`'.format(host))
-
-            log.info('Checking LDAP IP access %s', ip)
-            s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-            try:
-                s.connect((ip, int(port)))
-                s.shutdown(socket.SHUT_RD)
-            except Exception:
-                raise LdapConnectionError(
-                    'Failed to connect to host: `{}:{}`'.format(host, port))
-
-            return '{}:{}'.format(host, port)
-
-        port = self.LDAP_SERVER_PORT
-        return ', '.join(
-            ["{}://{}".format(
-                self.ldap_server_type, host_resolver(host, port))
-             for host in self.SERVER_ADDRESSES])
+class AuthLdap(AuthLdapBase):
 
     def __init__(self, server, base_dn, port=389, bind_dn='', bind_pass='',
                  tls_kind='PLAIN', tls_reqcert='DEMAND', ldap_version=3,
@@ -256,8 +220,9 b' class AuthLdap(object):'
         OPT_X_TLS_DEMAND = 2
         self.TLS_REQCERT = getattr(ldap, 'OPT_X_TLS_%s' % tls_reqcert,
                                    OPT_X_TLS_DEMAND)
+        self.LDAP_SERVER = server
         # split server into list
-        self.SERVER_ADDRESSES = server.split(',')
+        self.SERVER_ADDRESSES = self._get_server_list(server)
         self.LDAP_SERVER_PORT = port
 
         # USE FOR READ ONLY BIND TO LDAP SERVER
@@ -265,13 +230,12 b' class AuthLdap(object):'
 
         self.LDAP_BIND_DN = safe_str(bind_dn)
         self.LDAP_BIND_PASS = safe_str(bind_pass)
-        self.LDAP_SERVER = self._build_servers()
+
         self.SEARCH_SCOPE = getattr(ldap, 'SCOPE_%s' % search_scope)
         self.BASE_DN = safe_str(base_dn)
         self.LDAP_FILTER = safe_str(ldap_filter)
 
     def _get_ldap_conn(self):
-        log.debug('initializing LDAP connection to:%s', self.LDAP_SERVER)
 
         if self.debug:
             ldap.set_option(ldap.OPT_DEBUG_LEVEL, 255)
@@ -285,7 +249,10 b' class AuthLdap(object):'
         ldap.set_option(ldap.OPT_RESTART, ldap.OPT_ON)
 
         # init connection now
-        ldap_conn = ldap.initialize(self.LDAP_SERVER)
+        ldap_servers = self._build_servers(
+            self.ldap_server_type,  self.SERVER_ADDRESSES, self.LDAP_SERVER_PORT)
+        log.debug('initializing LDAP connection to:%s', ldap_servers)
+        ldap_conn = ldap.initialize(ldap_servers)
         ldap_conn.set_option(ldap.OPT_NETWORK_TIMEOUT, self.timeout)
         ldap_conn.set_option(ldap.OPT_TIMEOUT, self.timeout)
         ldap_conn.timeout = self.timeout
@@ -305,12 +272,6 b' class AuthLdap(object):'
 
         return ldap_conn
 
-    def get_uid(self, username):
-        uid = username
-        for server_addr in self.SERVER_ADDRESSES:
-            uid = chop_at(username, "@%s" % server_addr)
-        return uid
-
     def fetch_attrs_from_simple_bind(self, server, dn, username, password):
         try:
             log.debug('Trying simple bind with %s', dn)
@@ -336,7 +297,9 b' class AuthLdap(object):'
         :param password: password
         """
 
-        uid = self.get_uid(username)
+        uid = self.get_uid(username, self.SERVER_ADDRESSES)
+        user_attrs = {}
+        dn = ''
 
         if not password:
             msg = "Authenticating user %s with blank password not allowed"
@@ -350,8 +313,8 b' class AuthLdap(object):'
             ldap_conn = self._get_ldap_conn()
             filter_ = '(&%s(%s=%s))' % (
                 self.LDAP_FILTER, self.attr_login, username)
-            log.debug("Authenticating %r filter %s at %s", self.BASE_DN,
-                      filter_, self.LDAP_SERVER)
+            log.debug(
+                "Authenticating %r filter %s", self.BASE_DN, filter_)
             lobjects = ldap_conn.search_ext_s(
                 self.BASE_DN, self.SEARCH_SCOPE, filter_)
 

rhodecode/lib/hooks_utils.py

@@ -57,9 +57,6 b' def trigger_post_push_hook('
     :param repo_alias: the type of SCM repo
     :param commit_ids: list of commit ids that we pushed
     """
-    if repo_alias not in ('hg', 'git'):
-        return
-
     extras = _get_rc_scm_extras(username, repo_name, repo_alias, action)
     extras.commit_ids = commit_ids
     hooks_base.post_push(extras)