Commit Graph
29877 Commits
Author SHA1 Message Date
Papick Garcia Taboada 59297896ac Merge branch 'design2015' into design2015-user-management 2016-01-13 16:09:41 +01:00
Papick Garcia Taboada f5b860d315 Merge commit '803c91dd7879c58c8bfeb16ec26a855aafe340d9' into design2015
# Conflicts:
#	java/com.sap.sailing.gwt.ui/pom.xml
#	java/com.sap.sse.gwt.theme/pom.xml
#	java/pom.xml
2016-01-13 15:57:32 +01:00
Axel Uhl 803c91dd78 fixed position of race filter text box in TracTracEventManagementPanel
Change-Id: Ic7c8599f383184ac73775b48bb6431343b549277
2016-01-13 12:09:15 +01:00
Axel Uhl 1830f17cc5 Merge branch 'android-maven-build-bug3190' 2016-01-13 09:48:32 +01:00
Axel Uhl a08dc8f121 Merge remote-tracking branch 'server/master' 2016-01-12 18:18:58 +01:00
Axel Uhl ee2eb970ec call updated(TimePoint) on a DynamicTrackedRaceImpl for mark fixes which are now assumed to be restricted to the race's tracking duration
Change-Id: I8e2ad31d5480922268acf191cc9d1b5f4540f7a3
2016-01-12 18:14:31 +01:00
Jonas Dann 98fb0ba967 Link of Configure Races on Server pointed to wrong page 2016-01-12 11:52:27 +00:00
Axel Uhl 0217ae7c03 Merge remote-tracking branch 'server/android-maven-build-bug3190' into android-maven-build-bug3190 2016-01-12 12:48:44 +01:00
Axel Uhl 3917060c1a Merge branch 'master' into android-maven-build-bug3190
Conflicts:
	java/pom.xml

Change-Id: I8707442d05979fcd8e0a8be0b593ee3e94a513d3
2016-01-12 12:47:30 +01:00
Papick Garcia Taboada 84ff96fea6 Merge branch 'design2015-user-management' of ssh://sapsailing.com/home/trac/git into design2015-user-management 2016-01-12 10:00:12 +01:00
Axel Uhl ccc71c426a Merge remote-tracking branch 'server/master' 2016-01-12 09:57:53 +01:00
Papick Garcia Taboada 4237a379cd Merge commit '4332497ac993f28c7406d1936510f859090892c4' into design2015
# Conflicts:
#	java/com.sap.sse.security.ui/.settings/org.eclipse.core.resources.prefs
2016-01-12 09:56:00 +01:00
Axel Uhl f91153d93c cleaned up the ClientUtils implementation and removed unused OAuth cruft; removed GWT dependency from com.sap.sse.security;
removed RemoteServiceServlet superclass from SecurityServiceImpl; why was it there? The GWT RPC is implemented by
UserManagementServiceImpl

Change-Id: Ifc2e1f848b9fb5d7f24398a0497d301b037a822e
2016-01-12 09:43:07 +01:00
Axel Uhl 4e0c3f7073 providing update feature for additional User properties in SecurityService and UserManagementService
Change-Id: I46a4c2c58e35595dc20b85575a27c1cfbd639592
2016-01-12 09:28:23 +01:00
Axel Uhl fb3f74d297 added fields fullName and company to User
Change-Id: I831b2a229c29081aab8f79174caa8d1900303b67
2016-01-12 09:13:01 +01:00
Axel Uhl bfb9ecb9b5 using java.net.URLEncoder.encode to encode UUID parameter to startToReplicateFrom method
Change-Id: I6af165b62a09fbd28d59830b3bf910ab34f985e7
2016-01-11 21:43:58 +01:00
Axel Uhl f12f3d5f82 also using StringEscapeUtils.escapeHtml to escape competitor ID in exception/error message to avoid XSS attack
Change-Id: I9c70c02682dcac23238251faa13e0e4a2cc83ea5
2016-01-11 21:38:25 +01:00
Axel Uhl b885e975dc using another SafeHtmlUtils.fromString to escape a string to avoid XSS attacks
Change-Id: Ib90b5cfcf180f3643ef0eb1f9e49df9a792daf9c
2016-01-11 21:35:16 +01:00
Axel Uhl 4332497ac9 Updated fortify (markdown) 2016-01-11 13:26:20 +00:00
Axel Uhl 9ea2777da7 Merge remote-tracking branch 'server/master' 2016-01-11 14:11:05 +01:00
Axel Uhl c22dc1f0c3 Created fortify (markdown) 2016-01-11 13:05:43 +00:00
Axel Uhl 19c8ef792d Using a safeClose method in abstract super class HttpRequest
Change-Id: I16a66858b6f413aafad19025ed0f7ec973208ed1
2016-01-11 13:54:31 +01:00
Axel Uhl c18df38916 catch IOException during close in finally
Change-Id: Ia199b13d9669ee4397a3f494031efa4aaa318287
2016-01-11 13:49:10 +01:00
Axel Uhl 40ddcab65e Added link to new Fortify security scans document to Wiki home 2016-01-11 12:03:25 +00:00
Axel Uhl 571f113c0d consolidate import to clear warnings
Change-Id: I642af7b17622b0c823ae6baa10e0203ca59dbed6
2016-01-11 12:59:54 +01:00
Axel Uhl 6797656bd8 releasing camera also in onStop and onDestroy
Change-Id: I26887b13f742b38353461937fa73cf0234c226be
2016-01-11 12:57:23 +01:00
Axel Uhl 1c41fd8ef1 moved close() call into finally clause
Change-Id: I9802c78c0a21252a4b43a9fe7e3096656b18dee8
2016-01-11 12:42:00 +01:00
Axel Uhl c061ad0c41 removed redundant comments in AnalyticsProvider
Change-Id: I823d0306becac831b0ae093154ba570c24274b16
2016-01-11 09:50:43 +01:00
Axel Uhl 4a7242df2e replaced two more string concatenations in DatabaseHelper by ? and selectionArgs usage
Change-Id: I337277d604f9f28020db3fe41029cd551e293c6f
2016-01-11 09:43:10 +01:00
Axel Uhl ef3be27867 using ? query args in DatabaseHelper
Change-Id: I83f6a878d34196ba4f31fbbd2149cc547beed8ef
2016-01-11 09:41:13 +01:00
Axel Uhl 9a208d9105 removed redundant comments; enhanced logging by the exception
Change-Id: Id975b1134d3ff74d3fcb0202b642d32c2c29e255
2016-01-11 09:31:34 +01:00
Axel Uhl d4b2b34de3 omit exception message from log
Change-Id: Ic60cb62452376d20fda6a41e55e114cbe97f7cf9
2016-01-08 22:53:13 +01:00
Axel Uhl 47febe3d8c replaced e.printStackTrace by reasonable logging
Change-Id: Iead1364cf8438c88780621d93856b628d54c67ac
2016-01-08 22:49:38 +01:00
Axel Uhl 09a9eea119 avoid log forging
Change-Id: I449954fb97a7debdad0a311d8c434678140c287a
2016-01-08 22:28:46 +01:00
Axel Uhl aeb61b9dfe replaced e.printStackTrace() by proper logging statements
Change-Id: Ica5f8fac6fd7616126d546041b83669bc6a9fe36
2016-01-08 16:42:59 +01:00
Axel Uhl 95198ef094 replaced printStackTrace() by proper logging
Change-Id: I69ddb3f2284295ca079e6417204e09f711db466c
2016-01-08 16:30:51 +01:00
Axel Uhl bd36943783 added assert for non-null uri parameter
Change-Id: I867c8da773c21d5542bad4cd9317e59e09976a04
2016-01-08 16:27:36 +01:00
Axel Uhl 9c6824f13c added logging in previously empty exception handlers in ImageController
Change-Id: I88ec5fb80f76bdad387fdd1af103e03deb2c71af
2016-01-08 16:16:04 +01:00
Axel Uhl c74fc32f38 fixed imports
Change-Id: I87651dbccd82e986de12531ac5180ce483a02ead
2016-01-08 16:13:17 +01:00
Axel Uhl 7c7c55307b added logging statements into previously empty exception handlers
Change-Id: I57bd11858d3559ae470f2e7a455699793ce53730
2016-01-08 16:12:30 +01:00
Axel Uhl 6ba4d7d867 Fortify found this. In RacingActivity.registerOnService use start() instead of run() to launch thread in background
Change-Id: I2f64377e26a2e2a2cb27425a1e6bfeebebd8d422
2016-01-08 16:02:57 +01:00
Axel Uhl 76ac8458c7 more security fixes in accordance with the Fortify security scans; now all Corporate Security Requirements have been dealt with
Change-Id: I8badf465e3dfec80e194a5d8fa62d9019e65b646
2016-01-08 14:17:38 +01:00
Axel Uhl bfd33b20cd use parseStrict instead of parseLenient in URLFieldWithFileUpload; fixed <pre> wrapping by setting content type to text/html instead of application/json
Change-Id: I37852c582333b787e3a9ff8dfeef59e5703c1442
2016-01-08 11:23:32 +01:00
Axel Uhl 8246a64a3f using UriUtils.fromString to avoid XSS security vulnerability
Change-Id: Ia6aada15502dd1e4e6a53cf9e6067fbea6a07fef
2016-01-08 11:01:54 +01:00
Axel Uhl 29300c415d fixed a NullPointerException for file upload dialog widget: when starting file upload, URL field is still empty, causing the NPE
Change-Id: Ia9a41c0ce0b4eaeb567cd901d61d7253940f2c5f
2016-01-08 11:00:29 +01:00
Axel Uhl 44362206c9 audited and fixed reflective XSS vulnerabilities, mostly using StringEscapeUtils
Change-Id: If01b16aed1496818524b7b57528337f9c2bcbaa0
2016-01-08 09:48:37 +01:00
Axel Uhl 45c8576d02 Using Apache StringEscapeUtils.escapeHtml to make the reflection of URL parameter HTML safe
Change-Id: Ib77b0f83c4f935b9d90181434031fa74f2699248
2016-01-07 17:32:26 +01:00
Axel Uhl cb233be2eb using StringEscapeUtils.escapeHtml to escape XSS vulnerabilities
Change-Id: I2a10fb6d3c2bf5d0788ac2d69530caec17809f05
2016-01-07 17:27:11 +01:00
Axel Uhl 23f8487cf9 filter more explicitly for "localhost" in RedirectServlet
Change-Id: Ie8cf5857b52987e7d664aa65b387909f4ae4a932
2016-01-07 10:10:30 +01:00
Axel Uhl e2cfbf539d use SafeUriUtils for URL encoding
Change-Id: Ibdb7608b8d3d5768924dd4e111440dee876afd00
2016-01-07 10:09:21 +01:00