{"push_id":1159372885,"size":16,"distinct_size":16,"ref":"refs/heads/master","head":"3d30f5f9864fc9960fbbe505ed52963f5d44d7a0","before":"f61092b0d5dac3be2881beea0694964d29333fcc","commits":[{"sha":"de658f35ec74775adbba9d876522e7e5ac7b1e9d","author":{"name":"Aaron Wells","email":"6f6fa51af52ec86ab6d9c9e79b064d517ea0dad7@catalyst.net.nz"},"message":"callback.php shouldn't be public\n\nIt's only accessed by a logged-in user as part of the process of updating\ntheir own cloud artefacts. So the PUBLIC flag shouldn't be there.\n\nChange-Id: Ie25a087c0d2b0a808942dc2150b89eed4415c894","distinct":true,"url":"https://api.github.com/repos/povsod/mahara-artefact-cloud/commits/de658f35ec74775adbba9d876522e7e5ac7b1e9d"},{"sha":"ef381dbdbf7c2f1d9d61ffb086d7096aa8214ac9","author":{"name":"Aaron Wells","email":"6f6fa51af52ec86ab6d9c9e79b064d517ea0dad7@catalyst.net.nz"},"message":"Require logged-in user, or viewid, for details.php\n\nThe details.php page, if it includes a \"viewid\" parameter,\nshows the cloud stuff from that page. If it includes no\n\"viewid\", then it shows the cloud stuff from the current\nuser's cloud token.\n\nIf a logged-out user access details.php, they have no token,\nand this causes an unwieldy error message. So it's better\nto just say, if you're a logged-out user, you must provide\na view id.\n\nChange-Id: Id9e59908c8c3db9aad3df987eb32a9fff8753f1c","distinct":true,"url":"https://api.github.com/repos/povsod/mahara-artefact-cloud/commits/ef381dbdbf7c2f1d9d61ffb086d7096aa8214ac9"},{"sha":"1446e268a4b0126958aaad9c7f6b81e79042a669","author":{"name":"Aaron Wells","email":"6f6fa51af52ec86ab6d9c9e79b064d517ea0dad7@catalyst.net.nz"},"message":"Use a sesskey on account.php to mitigate risk of CSRF\n\nA malicious user could send someone a link to account.php,\ncausing them to log out or be prompted to log in to their\ncloud account. Adding the sesskey makes that harder to do.\n\nChange-Id: Ib8fd1b52be87bf67d0506d27381e94f492c669b6","distinct":true,"url":"https://api.github.com/repos/povsod/mahara-artefact-cloud/commits/1446e268a4b0126958aaad9c7f6b81e79042a669"},{"sha":"844c1d28f0656f485c06d8b0d5fba6e03a108a7b","author":{"name":"Aaron Wells","email":"6f6fa51af52ec86ab6d9c9e79b064d517ea0dad7@catalyst.net.nz"},"message":"Escape filenames in HTTP response headers\n\nThe filename in the HTTP \"Content-Disposition\"\nresponse is a \"quoted-string\", which is defined\nin RFC2616 as using a single backquote to escape\ndouble-quote characters.\nhttps://tools.ietf.org/html/rfc2616#section-2.2\n\nChange-Id: I98960bef9064ea39a3cd2d912d41cc0570273b4c","distinct":true,"url":"https://api.github.com/repos/povsod/mahara-artefact-cloud/commits/844c1d28f0656f485c06d8b0d5fba6e03a108a7b"},{"sha":"b9c78c4937314c0035e4e3e0b9f07c34e7bdd3b7","author":{"name":"Aaron Wells","email":"6f6fa51af52ec86ab6d9c9e79b064d517ea0dad7@catalyst.net.nz"},"message":"Whitelist display parameter before using it in fetch()\n\nThe \"display\" parameter comes from a form submission,\nwhich means that it's untrusted user data. We should\nmake sure to limit it to a strict list of known values.\nIn this case, \"list\" and \"embed\" are the only two\nlegal values.\n\nChange-Id: Idb90de9309d17b553f97b03da91fafca84585142","distinct":true,"url":"https://api.github.com/repos/povsod/mahara-artefact-cloud/commits/b9c78c4937314c0035e4e3e0b9f07c34e7bdd3b7"},{"sha":"43a5348001bfbff89f43cb3ebae900b3f8aaca9b","author":{"name":"Aaron Wells","email":"6f6fa51af52ec86ab6d9c9e79b064d517ea0dad7@catalyst.net.nz"},"message":"The one-parameter version of parse_str() is insecure\n\nIt's best to avoid PHP functionality that can convert user\ninput into variables in the PHP namespace, because this\nfunctionality is prone to security flaws. The two-parameter\nversion of parse_str() instead puts the output into an array,\npreventing a malicious user fram manipulating variables in\nthe namespace.\n\nChange-Id: Idfa97817bf1ce3861cb7480681c652d17dbc08e2","distinct":true,"url":"https://api.github.com/repos/povsod/mahara-artefact-cloud/commits/43a5348001bfbff89f43cb3ebae900b3f8aaca9b"},{"sha":"3820f68c24ab9b94b6aec3a9044656dd1e86e137","author":{"name":"Aaron Wells","email":"6f6fa51af52ec86ab6d9c9e79b064d517ea0dad7@catalyst.net.nz"},"message":"Explicitly include artefact/lib.php\n\nPerformance improvements in 16.04 mean that artefact/lib.php is\nno longer pre-loaded on every page load, so we need to load it\nexplicitly.\n\nChange-Id: Ic13227ab462b2a6f9ce5e01275b096e7f90bdf03","distinct":true,"url":"https://api.github.com/repos/povsod/mahara-artefact-cloud/commits/3820f68c24ab9b94b6aec3a9044656dd1e86e137"},{"sha":"985932ea67cf38461a88bf8f66e7522ec7cf415a","author":{"name":"Aaron Wells","email":"6f6fa51af52ec86ab6d9c9e79b064d517ea0dad7@catalyst.net.nz"},"message":"Need to include oauth token to revoke Dropbox token\n\nThe call to the Dropox api for revoking an OAuth token,\nwas not actually including the OAuth token. So, this\nmeant the token was not actually getting revoked.\n\nChange-Id: Ib6058b3fdd3b3989c898c2df70b0cf5542fb8b8a","distinct":true,"url":"https://api.github.com/repos/povsod/mahara-artefact-cloud/commits/985932ea67cf38461a88bf8f66e7522ec7cf415a"},{"sha":"5fc5096ece22357c9684c3139faed6b1e3508700","author":{"name":"Aaron Wells","email":"6f6fa51af52ec86ab6d9c9e79b064d517ea0dad7@catalyst.net.nz"},"message":"Disallow cloud blocks on group & institution pages\n\nThe cloud blocks don't work correctly on group and\ninstitution pages, because they try to use the access\ntokens of the page's owner. But group and institution\npages don't have an owner.\n\nChange-Id: I4934d1ee831b9ad45a1b8658973861d933308f38","distinct":true,"url":"https://api.github.com/repos/povsod/mahara-artefact-cloud/commits/5fc5096ece22357c9684c3139faed6b1e3508700"},{"sha":"2827b219e11d7146bcd86c58a346bddab12c6495","author":{"name":"Aaron Wells","email":"6f6fa51af52ec86ab6d9c9e79b064d517ea0dad7@catalyst.net.nz"},"message":"Better styling when the user has no directories\n\nIf the user has no directories in their Mahara\nContent->Files area (other than the home directory),\nthe directory selection menu turns into a div instead\nof a dropdown menu, and the styling breaks.\n\nIncluding the obscure pieform parameter \"collapseifoneoption\"\nand setting it to \"false\" prevents this from happening.\n\nChange-Id: I3674dc49291a7e51c3abac8f02e589fa4b55e92d","distinct":true,"url":"https://api.github.com/repos/povsod/mahara-artefact-cloud/commits/2827b219e11d7146bcd86c58a346bddab12c6495"},{"sha":"bc111837b4a3342916f54411be5057e24938fc6b","author":{"name":"Aaron Wells","email":"6f6fa51af52ec86ab6d9c9e79b064d517ea0dad7@catalyst.net.nz"},"message":"Use Mahara API's to store downloaded files\n\nAlso, because the code is identical for every cloud block,\nrefactoring it into the parent class.\n\nChange-Id: I0904c53129c43a6e6016b13a07cce87cc8c27097","distinct":true,"url":"https://api.github.com/repos/povsod/mahara-artefact-cloud/commits/bc111837b4a3342916f54411be5057e24938fc6b"},{"sha":"204ce3e39edfe8242bdc863801dfbd976444f571","author":{"name":"Aaron Wells","email":"6f6fa51af52ec86ab6d9c9e79b064d517ea0dad7@catalyst.net.nz"},"message":"Special handling for Google Cloud (because it exports instead of saving)\n\nChange-Id: Id26700be675a6348892a338102f677918d4e9f6b","distinct":true,"url":"https://api.github.com/repos/povsod/mahara-artefact-cloud/commits/204ce3e39edfe8242bdc863801dfbd976444f571"},{"sha":"110d90b01c48a1eba3ffdade917d40756cf7d960","author":{"name":"Aaron Wells","email":"6f6fa51af52ec86ab6d9c9e79b064d517ea0dad7@catalyst.net.nz"},"message":"Removing configform.js include, from Google Cloud\n\nIt looks like this was accidentally retained\nwhen the Google Cloud blocktype was copied\nfrom the Zotero blocktype.\n\nChange-Id: I360d45e0bebf938169ed4e8d4310370bc1425c8b","distinct":true,"url":"https://api.github.com/repos/povsod/mahara-artefact-cloud/commits/110d90b01c48a1eba3ffdade917d40756cf7d960"},{"sha":"34dfcb87f2c24f333794f132d82d5e4738cd688d","author":{"name":"Aaron Wells","email":"6f6fa51af52ec86ab6d9c9e79b064d517ea0dad7@catalyst.net.nz"},"message":"Expanding documentation\n\nChange-Id: I49356764741df36c0a898a569ce9db5c42e1b519","distinct":true,"url":"https://api.github.com/repos/povsod/mahara-artefact-cloud/commits/34dfcb87f2c24f333794f132d82d5e4738cd688d"},{"sha":"7925e977dcee4998346838f3ecc8fb318d36d0bd","author":{"name":"Aaron Wells","email":"6f6fa51af52ec86ab6d9c9e79b064d517ea0dad7@catalyst.net.nz"},"message":"Removing target=_blank links for security purposes\n\nSee https://mathiasbynens.github.io/rel-noopener/\n\nChange-Id: If6b14615975d0575a1b72141a71ef5ca76c40ea0","distinct":true,"url":"https://api.github.com/repos/povsod/mahara-artefact-cloud/commits/7925e977dcee4998346838f3ecc8fb318d36d0bd"},{"sha":"3d30f5f9864fc9960fbbe505ed52963f5d44d7a0","author":{"name":"Gregor Anželj","email":"c88f0fabf54a85b899c6605e735d64cd61e87294@gmail.com"},"message":"Merge pull request #8 from agwells/master\n\nSecurity & miscellaneous bug fixes","distinct":true,"url":"https://api.github.com/repos/povsod/mahara-artefact-cloud/commits/3d30f5f9864fc9960fbbe505ed52963f5d44d7a0"}]}
{"actor":{"display_login":"anzeljg"}}