Commit Graph

1712 Commits

Author SHA1 Message Date
Klaas van Schelven
b81f754b8c Support Python 3.14
make it so by [a] saying it is so and [b] testing it in the CI/CD
2025-11-09 20:12:55 +01:00
Klaas van Schelven
473d4de6d2 2.0.6 CHANGELOG 2025-11-08 23:37:11 +01:00
Klaas van Schelven
d979b17596 Merge commit from fork
Add mitigation for a 2nd class of brotli DOS attack
2025-11-08 23:36:29 +01:00
Klaas van Schelven
c63e23f096 Clarify why I believe the curren solution will not be stuck forever 2025-11-08 22:59:49 +01:00
Klaas van Schelven
1201f754e3 brotli decompress: avoid non-termination
Analys by @Cycloctane -- thanks!
2025-11-08 22:57:02 +01:00
Klaas van Schelven
1aa8e95892 Assign local variable for easier debugging 2025-11-08 20:37:51 +01:00
Klaas van Schelven
6a37cefc09 2.0.5 CHANGELOG 2025-11-08 11:49:04 +01:00
Klaas van Schelven
3f65544aab Merge pull request #266 from bugsink/brotli-bombs-and-1.2
Fixes for brotli bombs (associated with brotli-1.2 upgrade); GeneratorReader fix
2025-11-08 11:45:08 +01:00
Klaas van Schelven
b44e5cd28f Comments/docstrings 2025-11-08 11:37:40 +01:00
Klaas van Schelven
26f327a257 GeneratorReader: don't copy so much
this was exposed when dealing with things that yield in very big chunks
potentially (e.g. brotli bombs)

tests are more directly on the GeneratorReader itself now rather than
integrating this with particular genators-under-test.
2025-11-08 11:37:40 +01:00
Klaas van Schelven
aab062a11e Brotli streaming decompression: use output_buffer_limit
This became possible with brotli 1.2.0

It is my understanding pre-this change there was basically no
enforced limit on the amount of bytes "coming out" of
decompressor.process(); in other words: chunk size did not
apply to the most relevant (potentially blowing up) part of
the equation.

We had a MaxDataReader in place, but that would come "too late"
since all the mem-consuming stuff would happen right in brotli_generator
before any limiting would be possible.

See https://github.com/google/brotli/issues/1381
2025-11-08 11:37:40 +01:00
Klaas van Schelven
2e882dc7c0 Merge pull request #264 from bugsink/half-of-244
migrate snappea database on server-start for Docker to avoid lack of permissions on already-created files

As discussed on #244
2025-11-07 20:40:02 +01:00
Erwin Oegema
3acd93856d Always migrate snappea database
(cherry picked from commit 3c51122746db5b348ab95f289cef4efa9500d358)

See #244
2025-11-07 20:34:32 +01:00
Klaas van Schelven
591b97042c docker-compose-sample.yaml: more clearly email:password
See #261
2025-11-07 19:59:23 +01:00
Klaas van Schelven
1ea365e146 Typo in LICENSE 2025-11-04 09:31:58 +01:00
Klaas van Schelven
c38aace3ae Add debug setting for email-sending
Fix #86
2025-11-03 21:35:09 +01:00
Klaas van Schelven
0bbb00c6ad smtp.EmailBackend in the docker conf: be explicit about it 2025-11-03 21:04:28 +01:00
Klaas van Schelven
20e065c6e8 Comment about FileNotError 2025-10-27 21:53:31 +01:00
Klaas van Schelven
8ad7f97380 parse_timestamp: _actually_ parse as UTC when timezone not provided
See https://github.com/Sija/raven.cr/issues/100 for the thing that triggered this

Caused by spotting this in the (shared on discord) logs of one of our users:

```
RuntimeWarning: DateTimeField Event.timestamp received a naive datetime (2025-10-26 16:01:08) while time zone support is active.
```
2025-10-26 22:56:11 +01:00
Klaas van Schelven
2b5d2f90ba Comment default fail_silently=False behavior 2025-10-26 22:50:44 +01:00
Klaas van Schelven
32be257172 Fail to start when using non-sqlite for snappea
See #252

This is not backwards compatible (it will now hard-break), but given snappea's
rather particular design decisions this is probably for the best, and given
what else was just discovered on #252 I strongly doubt anyone was actually using
it in such setups anyway.
2025-10-23 22:11:57 +02:00
Klaas van Schelven
314154a6b7 Add more warnings about using non-sqlite for snappea in the conf templates
See #252
2025-10-23 21:58:49 +02:00
Klaas van Schelven
e55c0eb417 'poor mans's DB lock: lock the right DB
See #252 where the following error was triggered:

> django.db.transaction.TransactionManagementError: select_for_update cannot be
> used outside of a transaction.

I believe that this is caused by using a non-sqlite database for the snappea DB.
"You probably shouldn't" but at least our own behavior should be consistent.

I haven't been able to reproduce this particular error BTW, but at least I've
reproduced _some_ error conditions that this commit fixes.
2025-10-23 21:54:59 +02:00
Klaas van Schelven
dcaa1d5e72 Fix redirect on single-click actions when hosting at subdomain
`path_info` (pre-commit siutation) is precisely w/o script_name, but you
want to just redirect to where you are, which is `path`.

Fix #250, See #93
See:

https://docs.djangoproject.com/en/5.2/ref/request-response/#django.http.HttpRequest.path_info
https://docs.djangoproject.com/en/5.2/ref/request-response/#django.http.HttpRequest.path
2025-10-22 09:52:16 +02:00
Klaas van Schelven
d8fef759ca Add database vendor, version and machine arch to phonehome message
See #226, in the context of which having some idea of the number of
installations on 2.x w/ mariadb would have been very useful
2025-10-10 09:41:57 +02:00
Klaas van Schelven
9cb89ecf46 Markdown stacktrace: render with all frames
not just in-app ones;

basic principle: more info means the LLM (or whatever) has more to go by
2025-10-10 09:19:11 +02:00
Klaas van Schelven
e6e0118583 2.0.4 release notes 2025-10-09 22:53:32 +02:00
Klaas van Schelven
1b5cf8dea4 Add convert_mariadb_uuids command
Bugsink 2.0 upgraded to Django 5.2 (from 4.2) under the hood. However, Django
5.0 made it so that on MariaDB >= 10.7, UUIDFields are stored as native UUID
fields, and special conversion steps are required.

The Django 5.0 release notes suggest basically downgrading your existing UUIDs
to CharField values and sticking with that forever, but that's not a workable
solution for us for many reasons:

* Bugsink is multi-DB-backend, and this change would affect them all. I don't
  want to force postgres-users to downgrade just for this.

* Bugsink 2.0 is already out in the wild, and people who've deployed it on
  MariaDB >= 10.7 would already "be in the correct future" (have UUID columns).
  i.e. the "solution" would just create the inverse problem.

* What with new models with new UUID fields? We'd run the rist of a "mix" with
  all the future complexity that comes with _that_.

So I've decided to just bite the bullet and force an upgrade. The provided
command allows users to upgrade their data. Just run:

```
bugsink-manage convert_mariadb_uuids
```

I have not (yet) provided this as a migration (it's always an option for the
future)... mostly for lack of time but also because we "need this as a command
anyway"... because people that would be on MariaDB < 10.7 still need this
tool whenever they migrate to >= 10.7.

Fix #226
2025-10-09 22:47:00 +02:00
Klaas van Schelven
43b1d63030 2.0.3 CHANGELOG 2025-10-05 14:47:54 +02:00
Klaas van Schelven
f8be55da89 Simplify login template
See #236 (for context, not for something that's solved by this):

> I did just notice that whatever the form validation error on-login is, the
> above message is shown. I will fix that at least to make debugging the above
> easier in the future. (i.e.: to make it so that if the form data is missing
> entirely, you'd get a "this field is required" for both fields)

This also gets rid of the lock/person but I don't care enough for those
to keep them around.
2025-10-01 17:13:39 +02:00
Klaas van Schelven
a20e10ef09 Hide development server warning: development only 2025-09-27 13:35:31 +02:00
Klaas van Schelven
d0e7b75dbb Better hints for malformed Token headers 2025-09-26 15:15:31 +02:00
Klaas van Schelven
afd31d2263 API: datetime objects always in UTC
i.e. avoid the pain of time-conversions when 'talking with computers'.
2025-09-26 15:01:55 +02:00
Klaas van Schelven
0ca3e33e1f API: remove 'is_deleted' as a field
it's implicit(ly not so): soft-deleted items should
not be returned, and everything that's returned isn't
deleted
2025-09-26 13:53:51 +02:00
Klaas van Schelven
16eccea851 Fix null constraint failure when remote_addr is None and user is '{{auto}}'
Fix #229
2025-09-23 10:14:28 +02:00
Klaas van Schelven
3e0309a422 2.0.2 CHANGELOG 2025-09-22 21:07:20 +02:00
Klaas van Schelven
5913af4824 Checkbox: restore dark mode to pre-migration behavior
Before the Tailwind 4 migration, checkboxes behaved as follows:

  Light mode
    checked   → cyan bg + white checkmark
    unchecked → white bg
  Dark mode
    checked   → cyan bg + white checkmark
    unchecked → dark bg

In the last commit, we fixed white-on-white, but because we removed
dark:bg-... as well, unchecked boxes in dark mode regressed to white,
standing out like a sore thumb against the dark background.

The current commit adds back the pre-migration behavior; it's not
actually a value-judgement on it other than "it was at least functioning".
(this non-value-judgement is directed at "do I really like cyan bg + white
checkmark in dark mode... I might not)

Fix #225
2025-09-22 20:34:25 +02:00
Klaas van Schelven
0b863b97a4 Checkbox styling: remove bg-white to fix invisible checkmark
After upgrading to Tailwind 4, the styled checkbox showed no checkmark when
checked. DevTools inspection showed a white-on-white rendering: the checkmark
SVG was filled white while the background was also white. Removing the
bg-white class restores the intended text-* color, making the checkmark
visible again.

The class bg-white was added in 4c8fb20daa i.e. in our first attempt
to get a non-ugly checkbox styling; whether it was "ever needed for realz"
is of historic interest mostly.

Fix #225
2025-09-22 16:39:44 +02:00
Klaas van Schelven
e60fbb2cd5 Fix invalid focus:ring-3-* classnames from migration
Tailwind 3 -> 4 migration renamed `ring` -> `ring-3`, but colors like
`ring-cyan-200` were also changed to `ring-3-cyan-200` which doesn't
actually exist.

broken in ac8e2e8cd6

See #225 (the present commit is related, but not a full fix)
2025-09-22 09:50:35 +02:00
Klaas van Schelven
4d3756f621 API: leave notes on get_object's future 2025-09-18 20:12:28 +02:00
Klaas van Schelven
3f6e062bed Merge pull request #223 from bugsink/dependabot/pip/python-packages-fe51b871b5
Update whitenoise requirement from ==6.10.* to ==6.11.* in the python-packages group
2025-09-18 19:42:24 +02:00
dependabot[bot]
1e81c95924 Update whitenoise requirement in the python-packages group
Updates the requirements on [whitenoise](https://github.com/evansd/whitenoise) to permit the latest version.

Updates `whitenoise` to 6.11.0
- [Changelog](https://github.com/evansd/whitenoise/blob/main/docs/changelog.rst)
- [Commits](https://github.com/evansd/whitenoise/compare/6.10.0...6.11.0)

---
updated-dependencies:
- dependency-name: whitenoise
  dependency-version: 6.11.0
  dependency-type: direct:production
  dependency-group: python-packages
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-09-18 15:16:04 +00:00
Klaas van Schelven
018e934bdb Reference sourcemaps instruction in JS SDK page 2025-09-17 20:49:22 +02:00
Klaas van Schelven
cc343d4f2c GitHub workflows: add minimal test for the Docker build (#221) 2025-09-16 12:19:16 +02:00
Klaas van Schelven
03081407cd 2.0.1 CHANGELOG 2025-09-16 12:13:58 +02:00
Klaas van Schelven
7bf74fda67 Merge pull request #220 from bugsink/workflow-do-test-without-settings
GitHub workflows: bugsink-manage in settingless mode
2025-09-16 11:50:25 +02:00
Klaas van Schelven
88bc283939 GitHub workflows: bugsink-manage in settingless mode
Fix #219
2025-09-16 11:44:03 +02:00
Klaas van Schelven
aa799e9c94 Fix import order between Bugsink and DRF
Move DRF/OpenAPI authentication import out of bugsink/__init__.py into
bugsink/authentication.py.

Before: running bugsink-manage imported the bugsink package, whose __init__
pulled in drf_spectacular → DRF → DRF’s api_settings before Django settings
were configured, raising ImproperlyConfigured. (Did not happen in dev where
apps are loaded after settings.)

After: DRF is first touched during server load via urls → routers → views →
schemas. Only then does DRF’s api_settings resolve DEFAULT_AUTHENTICATION_CLASSES,
importing bugsink.authentication at a point where settings are already ready.
2025-09-16 11:08:21 +02:00
Klaas van Schelven
e346f8d5c2 Fix useradd in Dockerfile*
exposed while trying to release 2.0.0
2025-09-16 10:55:29 +02:00
Klaas van Schelven
4fd0ba04fd Update hardcoded list of branches in GitHub CI workflow
in anticipation of the upcoming 2.0 release
see 87f5a5887e
2025-09-16 08:58:47 +02:00