[checkmk-commits] [tribe29/checkmk] 0dfaf9: 10703 SEC Fix some reflected XSS issues

Branch: refs/heads/1.6.0 Home: https://github.com/tribe29/checkmk Commit: 0dfaf9e393271d66121339d65bb566325b2cdce3 https://github.com/tribe29/checkmk/commit/0dfaf9e393271d66121339d65bb566325… Author: Lars Michelsen &lt;lm(a)tribe29.com&gt; Date: 2020-01-20 (Mon, 20 Jan 2020) Changed paths: A .werks/10703 M cmk/gui/valuespec.py Log Message: ----------- 10703 SEC Fix some reflected XSS issues Fixed several reflected XSS issues that were possible because some webservice responses that may contain user provided strings were not correctly encoded. Change-Id: I7cd6c0de48a4d71f84817eff08cfb252e185ac4a Commit: 9fc5d7262349404f2f0f154e75cb24b59a936d8c https://github.com/tribe29/checkmk/commit/9fc5d7262349404f2f0f154e75cb24b59… Author: Lars Michelsen &lt;lm(a)tribe29.com&gt; Date: 2020-01-20 (Mon, 20 Jan 2020) Changed paths: M cmk/utils/paths.py M cmk_base/packaging.py M tests/integration/cmk/utils/test_paths.py Log Message: ----------- Optional MKP management: Backport 1 Backport of 53f2e60f6fa845c5d0b519c5dff4154eabb3c06f Change-Id: I7d87ee344bdfdfb2cc6e65aa96d795444dad8ec3 Commit: 2c136eedcbd8cfde17428327217a8828a7081e0a https://github.com/tribe29/checkmk/commit/2c136eedcbd8cfde17428327217a8828a… Author: Lars Michelsen &lt;lm(a)tribe29.com&gt; Date: 2020-01-20 (Mon, 20 Jan 2020) Changed paths: A .werks/10560 M cmk_base/packaging.py Log Message: ----------- 10560 Extension packages: Add informational "Valid until version" field Checkmk extension packages (MKPs) can now have a new field, which is named "Valid until Checkmk version". A package provider can now declare that a package is useful until a specific Checkmmk version. This may be useful when backporting fixes or features to older versions where it is already known that the official Checkmk package ships the same things as the package. Please note that this field is only for informational purposes at the moment. There is no automatic disabling of extension packages based on this field. Change-Id: I90dea4e5d1e595c2c488623c9a94f1f33b65469c Commit: f227618eb656e90768665fb541d6010944ffb258 https://github.com/tribe29/checkmk/commit/f227618eb656e90768665fb541d601094… Author: Lars Michelsen &lt;lm(a)tribe29.com&gt; Date: 2020-01-20 (Mon, 20 Jan 2020) Changed paths: A .werks/10564 M tests/unit/cmk_base/test_unit_automations.py A web/htdocs/themes/classic/images/icon_install.png A web/htdocs/themes/facelift/images/icon_install.png Log Message: ----------- 10564 Extension packages: Checkmk can now ship optional packages Checkmk can now ship optional extension packages. This feature has been introduced to be able to provide feature previews in stable versions. Instead of introducing backported features for all users, we can now create backports, pack them into optional extension packages. Each user can then decide to install the package or not. After installation these packages are treated exactly like manually uploaded extension packages and can be removed in the same way. Enterprise Edition users can install the optional extension packages using the dialog "WATO > Extension packages". Raw Edition users can find optional extension packages in the path <tt>share/check_mk/optional_packages</tt> once we ship those packages. At the moment there is no such package shipped with Checkmk. The first optional extension packages may be added to Checkmk 1.6 in the next weeks. Change-Id: I185865862001692d2b7d93eb01ce1ecfdb1cea18 Compare: https://github.com/tribe29/checkmk/compare/cba16da745b9...f227618eb656