Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE:Leap:15.6:Update
python-Flask-Security-Too.26162
python-Flask-Security-Too.changes
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File python-Flask-Security-Too.changes of Package python-Flask-Security-Too.26162
------------------------------------------------------------------- Wed Sep 21 15:03:23 UTC 2022 - Daniel Garcia <daniel.garcia@suse.com> - Add fix-open-redirect.patch fixing bsc#1202105 (CVE-2021-23385) to avoid open redirect. This patch is based on the upstream pull request, gh#flask-middleware/flask-security#489, that fixes the upstream issue gh#flask-middleware/flask-security#486 ------------------------------------------------------------------- Sun Aug 21 16:58:33 UTC 2022 - Matej Cepl <mcepl@suse.com> - Add CVE-2021-21241-GET-reqs-auth-token.patch fixing bsc#1181058 (CVE-2021-21241) avoiding leak of authentication token in GET request. ------------------------------------------------------------------- Thu May 14 07:12:48 UTC 2020 - Antonio Larrosa <alarrosa@suse.com> - Decrease dependencies which aren't really required so we can build in SLE/Leap: * Werkzeug 0.15.5 requirement decreased to 0.14.1 * cryptography 2.3.1 requirement decreased to 2.1.4 * bcrypt 3.1.5 requirement decreased to 3.1.4 * peewee 3.11.2 requirement decreased to 3.7.1 * Remove python-pony requirement - Add patch that applies previous dependency changes: * fix-dependencies.patch ------------------------------------------------------------------- Thu May 14 06:27:54 UTC 2020 - Tomáš Chvátal <tchvatal@suse.com> - Add patch to not pull in babel/twine/pytest-runner as upstream needs those but we really don't require them during a rpm build: * no-setup-dependencies.patch ------------------------------------------------------------------- Thu May 7 10:42:20 UTC 2020 - Antonio Larrosa <alarrosa@suse.com> - Update to 3.4.2: * The flask-security repo was moved to a github organization Flask-Middleware. - Update to 3.4.1: * Fix a bunch of bugs in new unified sign in along with a couple other major issues. * (:issue:`298`) Alternative ID feature ran afoul of postgres/psycopg2 finickiness. * (:issue:`300`) JSON 401 responses had WWW-Authenticate Header attached - that caused browsers to pop up their own login/password form. Not what applications want. * (:issue:`280`) Allow admin/api to setup TFA (and unified sign in) out of band. Please see :meth:`.UserDatastore.tf_set`, :meth:`.UserDatastore.tf_reset`, :meth:`.UserDatastore.us_set`, :meth:`.UserDatastore.us_reset` and :meth:`.UserDatastore.reset_user_access`. * (:pr:`305`) We used form._errors which wasn't very pythonic, and it was removed in WTForms 2.3.0. * (:pr:`310`) WTForms 2.3.0 made email_validator optional, we need it. - Added Requires python-bcrypt and python-email_validator, Recommends python-PyQRCode, python-SQLAlchemy, python-zxcvbn and Suggests python-argon2_cffi and python-phonenumbers ------------------------------------------------------------------- Sun Apr 5 07:58:15 UTC 2020 - Tomáš Chvátal <tchvatal@suse.com> - Update to 3.4.0: * (:pr:`257`) Support a unified sign in feature. Please see :ref:`unified-sign-in`. * (:pr:`265`) Add phone number validation class. This is used in both unified sign in as well as two-factor when using sms. * (:pr:`274`) Add support for 'freshness' of caller's authentication. This permits endpoints to be additionally protected by ensuring a recent authentication. * (:issue:`99`, :issue:`195`) Support pluggable password validators. Provide a default validator that offers complexity and breached support. * (:issue:`266`) Provide interface to two-factor send_token so that applications can provide error mitigation. Defaults to returning errors if can't send the verification code. * (:pr:`247`) Updated all-inclusive data models (fsqlaV2). Add fields necessary for the new unified sign in feature and changed 'username' to be unique (but not required). * (:pr:`245`) Use fs_uniquifier as the default Flask-Login 'alternative token'. Basically this means that changing the fs_uniquifier will cause outstanding auth tokens, session and remember me cookies to be invalidated. So if an account gets compromised, an admin can easily stop access. Prior to this cookies were storing the 'id' which is the user's primary key - difficult to change! (kishi85) - Enable the testing - Add patch to not require mongodb during testing: * no-mongodb.patch ------------------------------------------------------------------- Tue Mar 24 15:35:47 UTC 2020 - Antonio Larrosa <alarrosa@suse.com> - Initial release of python-Flask-Security-Too 3.3.0
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor