diff --git a/.env.docker b/.env.docker index afa556dc..e5c1c70c 100644 --- a/.env.docker +++ b/.env.docker @@ -3,6 +3,7 @@ # Application export FLASK_ENV=development export FLASK_APP=fittrackee/__main__.py +export FLASK_SKIP_DOTENV=1 export APP_SETTINGS=fittrackee.config.DevelopmentConfig export APP_SECRET_KEY='just for test' # export APP_WORKERS= diff --git a/.env.example b/.env.example index adc1939f..03c339fb 100644 --- a/.env.example +++ b/.env.example @@ -3,6 +3,7 @@ # Application # export FLASK_APP=fittrackee +export FLASK_SKIP_DOTENV=1 # export HOST= # export PORT= # export APP_SETTINGS=fittrackee.config.ProductionConfig diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 6264413a..884434da 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -93,7 +93,6 @@ firefox: - poetry config virtualenvs.create false - poetry install --no-interaction --quiet - flask db upgrade --directory fittrackee/migrations - - flask init-data - setsid nohup flask run --with-threads -h 0.0.0.0 -p 5000 >> nohup.out 2>&1 & - export TEST_APP_URL=http://$(hostname --ip-address):5000 - sleep 5 diff --git a/CHANGELOG.md b/CHANGELOG.md index ea3214dd..fb5631df 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,42 @@ # Change log +## Version 0.5.7 (2022/02/13) + +This release contains several fixes including security fixes. +Thanks to @DanielSiersleben for the report. + +And from now on, admin account is not created on application initialization. +A new command is added to set administration rights on the account created after registration +(see [documentation](https://samr1.github.io/FitTrackee/installation.html#upgrade)) + +### Issues Closed + +#### Misc + +* [#149](https://github.com/SamR1/FitTrackee/issues/149) - improve database initialisation + +### Pull Requests + +#### Security + +* [#152](https://github.com/SamR1/FitTrackee/pull/152) - Fixes and improvements: + - set autoescape on jinja templates + +* [#151](https://github.com/SamR1/FitTrackee/pull/151) - fix security issues: + - sanitize input when serving images + - sanitize inputs when serving map tiles + - allow only alphanumeric characters and '_' in username + +#### Misc + +* [#152](https://github.com/SamR1/FitTrackee/pull/152) - Fixes and improvements: + - fix dramatiq warning when launching workers w/ script entrypoint + - check app config before dropping database, to avoid deleting data on production + - remove dotenv warning + +In this release 1 issue was closed. + + ## Version 0.5.6 (2022/02/05) ### Issues Closed diff --git a/Makefile b/Makefile index 5ef48d89..7e8c8e49 100644 --- a/Makefile +++ b/Makefile @@ -59,6 +59,9 @@ docker-serve-client: docker-compose -f docker-compose-dev.yml up -d fittrackee_client docker-compose -f docker-compose-dev.yml exec fittrackee_client yarn serve +docker-set-admin: + docker-compose -f docker-compose-dev.yml exec fittrackee docker/set-admin.sh $(USERNAME) + docker-shell: docker-compose -f docker-compose-dev.yml exec fittrackee docker/shell.sh @@ -85,15 +88,10 @@ html: install-db: psql -U postgres -f db/create.sql $(FLASK) db upgrade --directory $(MIGRATIONS) - $(FLASK) init-data - -init-app-config: - $(FLASK) init-app-config init-db: $(FLASK) drop-db $(FLASK) db upgrade --directory $(MIGRATIONS) - $(FLASK) init-data install: install-client install-python @@ -133,9 +131,6 @@ mail: migrate-db: $(FLASK) db migrate --directory $(MIGRATIONS) -recalculate: - $(FLASK) recalculate - revision: $(FLASK) db revision --directory $(MIGRATIONS) --message $(MIGRATION_MESSAGE) @@ -166,6 +161,9 @@ serve-python-dev: echo 'Running on https://$(HOST):$(PORT)' $(FLASK) run --with-threads -h $(HOST) -p $(PORT) --cert=adhoc +set-admin: + $(FLASK) users set-admin $(USERNAME) + test-e2e: init-db $(PYTEST) e2e --driver firefox $(PYTEST_ARGS) diff --git a/VERSION b/VERSION index b49b2533..d3532a10 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -0.5.6 +0.5.7 diff --git a/docker/init-database.sh b/docker/init-database.sh index ece8cc19..c89017b9 100755 --- a/docker/init-database.sh +++ b/docker/init-database.sh @@ -5,5 +5,4 @@ cd /usr/src/app source .env.docker flask drop-db -flask db upgrade --directory fittrackee/migrations -flask init-data \ No newline at end of file +flask db upgrade --directory fittrackee/migrations \ No newline at end of file diff --git a/docker/set-admin.sh b/docker/set-admin.sh new file mode 100755 index 00000000..04f94441 --- /dev/null +++ b/docker/set-admin.sh @@ -0,0 +1,7 @@ +#!/bin/bash +set -e +cd /usr/src/app + +source .env.docker + +flask users set-admin $1 diff --git a/docs/.buildinfo b/docs/.buildinfo index 83e8c70e..a14cf30c 100644 --- a/docs/.buildinfo +++ b/docs/.buildinfo @@ -1,4 +1,4 @@ # Sphinx build info version 1 # This file hashes the configuration used when building these files. When it is not found, a full rebuild will be done. -config: 07e52347d325bc590b4a2ded72b46e83 +config: 1e2841616c48de88a07f12a07138022e tags: 645f666f9bcd5a90fca523b33c5a78b7 diff --git a/docs/_images/fittrackee_screenshot-01.png b/docs/_images/fittrackee_screenshot-01.png index ef114f7a..19dd60ef 100644 Binary files a/docs/_images/fittrackee_screenshot-01.png and b/docs/_images/fittrackee_screenshot-01.png differ diff --git a/docs/_images/fittrackee_screenshot-02.png b/docs/_images/fittrackee_screenshot-02.png index 113b0c6e..acf1465a 100644 Binary files a/docs/_images/fittrackee_screenshot-02.png and b/docs/_images/fittrackee_screenshot-02.png differ diff --git a/docs/_images/fittrackee_screenshot-03.png b/docs/_images/fittrackee_screenshot-03.png index ce4ccf87..0d61477d 100644 Binary files a/docs/_images/fittrackee_screenshot-03.png and b/docs/_images/fittrackee_screenshot-03.png differ diff --git a/docs/_images/fittrackee_screenshot-04.png b/docs/_images/fittrackee_screenshot-04.png index 1f691419..dbc9820f 100644 Binary files a/docs/_images/fittrackee_screenshot-04.png and b/docs/_images/fittrackee_screenshot-04.png differ diff --git a/docs/_images/fittrackee_screenshot-05.png b/docs/_images/fittrackee_screenshot-05.png index c05a3882..f912b82d 100644 Binary files a/docs/_images/fittrackee_screenshot-05.png and b/docs/_images/fittrackee_screenshot-05.png differ diff --git a/docs/_images/fittrackee_screenshot-06.png b/docs/_images/fittrackee_screenshot-06.png index aa268344..e5b448e5 100644 Binary files a/docs/_images/fittrackee_screenshot-06.png and b/docs/_images/fittrackee_screenshot-06.png differ diff --git a/docs/_sources/changelog.md.txt b/docs/_sources/changelog.md.txt index ea3214dd..fb5631df 100644 --- a/docs/_sources/changelog.md.txt +++ b/docs/_sources/changelog.md.txt @@ -1,5 +1,42 @@ # Change log +## Version 0.5.7 (2022/02/13) + +This release contains several fixes including security fixes. +Thanks to @DanielSiersleben for the report. + +And from now on, admin account is not created on application initialization. +A new command is added to set administration rights on the account created after registration +(see [documentation](https://samr1.github.io/FitTrackee/installation.html#upgrade)) + +### Issues Closed + +#### Misc + +* [#149](https://github.com/SamR1/FitTrackee/issues/149) - improve database initialisation + +### Pull Requests + +#### Security + +* [#152](https://github.com/SamR1/FitTrackee/pull/152) - Fixes and improvements: + - set autoescape on jinja templates + +* [#151](https://github.com/SamR1/FitTrackee/pull/151) - fix security issues: + - sanitize input when serving images + - sanitize inputs when serving map tiles + - allow only alphanumeric characters and '_' in username + +#### Misc + +* [#152](https://github.com/SamR1/FitTrackee/pull/152) - Fixes and improvements: + - fix dramatiq warning when launching workers w/ script entrypoint + - check app config before dropping database, to avoid deleting data on production + - remove dotenv warning + +In this release 1 issue was closed. + + ## Version 0.5.6 (2022/02/05) ### Issues Closed diff --git a/docs/_sources/installation.rst.txt b/docs/_sources/installation.rst.txt index 74a5be38..b9d46376 100644 --- a/docs/_sources/installation.rst.txt +++ b/docs/_sources/installation.rst.txt @@ -269,19 +269,12 @@ For instance, copy and update ``.env`` file from ``.env.example`` and source the $ nano .env $ source .env - -- Upgrade database schema +- Initialize database schema .. code-block:: bash $ fittrackee_upgrade_db -- Initialize database - -.. code-block:: bash - - $ fittrackee_init_data - - Start the application .. code-block:: bash @@ -297,6 +290,14 @@ For instance, copy and update ``.env`` file from ``.env.example`` and source the .. note:: | To start application and workers with **systemd** service, see `Deployment `__ +- Open http://localhost:3000 and register + +- To set admin rights to the newly created account, use the following command: + +.. code:: bash + + $ fittrackee_set_admin + From sources ^^^^^^^^^^^^ @@ -349,8 +350,13 @@ Dev environment $ make run-workers -Open http://localhost:3000 and log in (the email is ``admin@example.com`` -and the password ``mpwoadmin``) or register +- Open http://localhost:3000 and register + +- To set admin rights to the newly created account, use the following command: + +.. code:: bash + + $ make set-admin USERNAME= Production environment @@ -359,13 +365,13 @@ Production environment .. warning:: | Note that FitTrackee is under heavy development, some features may be unstable. -- Download the last release (for now, it is the release v0.5.6): +- Download the last release (for now, it is the release v0.5.7): .. code:: bash - $ wget https://github.com/SamR1/FitTrackee/archive/v0.5.6.tar.gz - $ tar -xzf v0.5.6.tar.gz - $ mv FitTrackee-0.5.6 FitTrackee + $ wget https://github.com/SamR1/FitTrackee/archive/v0.5.7.tar.gz + $ tar -xzf v0.5.7.tar.gz + $ mv FitTrackee-0.5.7 FitTrackee $ cd FitTrackee - Create **.env** from example and update it @@ -390,9 +396,13 @@ Production environment $ make run -Open http://localhost:5000, log in as admin (the email is -``admin@example.com`` and the password ``mpwoadmin``) and change the -password +- Open http://localhost:5000 and register + +- To set admin rights to the newly created account, use the following command: + +.. code:: bash + + $ make set-admin USERNAME= Upgrade @@ -477,13 +487,13 @@ Prod environment - Change to the directory where FitTrackee directory is located -- Download the last release (for now, it is the release v0.5.6) and overwrite existing files: +- Download the last release (for now, it is the release v0.5.7) and overwrite existing files: .. code:: bash - $ wget https://github.com/SamR1/FitTrackee/archive/v0.5.6.tar.gz - $ tar -xzf v0.5.6.tar.gz - $ cp -R FitTrackee-0.5.6/* FitTrackee/ + $ wget https://github.com/SamR1/FitTrackee/archive/v0.5.7.tar.gz + $ tar -xzf v0.5.7.tar.gz + $ cp -R FitTrackee-0.5.7/* FitTrackee/ $ cd FitTrackee - Update **.env** if needed (see `Environment variables `__). @@ -642,10 +652,16 @@ installing **FitTrackee** from **sources**. $ cd FitTrackee $ make docker-build docker-run docker-init -Open http://localhost:5000, log in as admin (the email is `admin@example.com` and the password `mpwoadmin`) or register. +Open http://localhost:5000 and register. Open http://localhost:8025 to access `MailHog interface `_ (email testing tool) +- To set admin rights to the newly created account, use the following command: + +.. code:: bash + + $ make docker-set-admin USERNAME= + - To stop **Fittrackee**: .. code-block:: bash @@ -683,8 +699,7 @@ Development $ make docker-serve-client -Open http://localhost:3000 and log in (the email is ``admin@example.com`` -and the password ``mpwoadmin``) or register +Open http://localhost:3000 .. note:: Some environment variables need to be updated like `UI_URL` \ No newline at end of file diff --git a/docs/_static/documentation_options.js b/docs/_static/documentation_options.js index bc550202..d3c9969f 100644 --- a/docs/_static/documentation_options.js +++ b/docs/_static/documentation_options.js @@ -1,6 +1,6 @@ var DOCUMENTATION_OPTIONS = { URL_ROOT: document.getElementById("documentation_options").getAttribute('data-url_root'), - VERSION: '0.5.6', + VERSION: '0.5.7', LANGUAGE: 'None', COLLAPSE_INDEX: false, BUILDER: 'html', diff --git a/docs/api/auth.html b/docs/api/auth.html index 17ff90e6..751b5193 100644 --- a/docs/api/auth.html +++ b/docs/api/auth.html @@ -5,7 +5,7 @@ - Authentication — FitTrackee 0.5.6 + <title>Authentication — FitTrackee 0.5.7 documentation @@ -40,7 +40,7 @@ FitTrackee - 0.5.6 + 0.5.7 diff --git a/docs/api/configuration.html b/docs/api/configuration.html index 20de675f..362aa3d7 100644 --- a/docs/api/configuration.html +++ b/docs/api/configuration.html @@ -5,7 +5,7 @@ - Configuration — FitTrackee 0.5.6 + <title>Configuration — FitTrackee 0.5.7 documentation @@ -40,7 +40,7 @@ FitTrackee - 0.5.6 + 0.5.7 @@ -148,7 +148,7 @@ "max_zip_file_size": 10485760, "max_users": 0, "map_attribution": "&copy; <a href=http://www.openstreetmap.org/copyright>OpenStreetMap</a> contributors" - "version": "0.5.6" + "version": "0.5.7" }, "status": "success" } diff --git a/docs/api/index.html b/docs/api/index.html index fd71d0f6..d2fd0d6f 100644 --- a/docs/api/index.html +++ b/docs/api/index.html @@ -5,7 +5,7 @@ - API documentation — FitTrackee 0.5.6 + <title>API documentation — FitTrackee 0.5.7 documentation @@ -40,7 +40,7 @@ FitTrackee - 0.5.6 + 0.5.7 diff --git a/docs/api/records.html b/docs/api/records.html index 74a00d04..5753f656 100644 --- a/docs/api/records.html +++ b/docs/api/records.html @@ -5,7 +5,7 @@ - Records — FitTrackee 0.5.6 + <title>Records — FitTrackee 0.5.7 documentation @@ -40,7 +40,7 @@ FitTrackee - 0.5.6 + 0.5.7 diff --git a/docs/api/sports.html b/docs/api/sports.html index 1a1882b7..76b972e9 100644 --- a/docs/api/sports.html +++ b/docs/api/sports.html @@ -5,7 +5,7 @@ - Sports — FitTrackee 0.5.6 + <title>Sports — FitTrackee 0.5.7 documentation @@ -40,7 +40,7 @@ FitTrackee - 0.5.6 + 0.5.7 diff --git a/docs/api/stats.html b/docs/api/stats.html index 67efd976..7f1f0a69 100644 --- a/docs/api/stats.html +++ b/docs/api/stats.html @@ -5,7 +5,7 @@ - Statistics — FitTrackee 0.5.6 + <title>Statistics — FitTrackee 0.5.7 documentation @@ -40,7 +40,7 @@ FitTrackee - 0.5.6 + 0.5.7 diff --git a/docs/api/users.html b/docs/api/users.html index d69f82b0..6c73e489 100644 --- a/docs/api/users.html +++ b/docs/api/users.html @@ -5,7 +5,7 @@ - Users — FitTrackee 0.5.6 + <title>Users — FitTrackee 0.5.7 documentation @@ -40,7 +40,7 @@ FitTrackee - 0.5.6 + 0.5.7 diff --git a/docs/api/workouts.html b/docs/api/workouts.html index 7d74684c..39205ea4 100644 --- a/docs/api/workouts.html +++ b/docs/api/workouts.html @@ -5,7 +5,7 @@ - Workouts — FitTrackee 0.5.6 + <title>Workouts — FitTrackee 0.5.7 documentation @@ -40,7 +40,7 @@ FitTrackee - 0.5.6 + 0.5.7 diff --git a/docs/changelog.html b/docs/changelog.html index e1ade063..aba2fc45 100644 --- a/docs/changelog.html +++ b/docs/changelog.html @@ -5,7 +5,7 @@ - Change log — FitTrackee 0.5.6 + <title>Change log — FitTrackee 0.5.7 documentation @@ -39,7 +39,7 @@ FitTrackee - 0.5.6 + 0.5.7 @@ -77,192 +77,204 @@ role="menu" aria-labelledby="dLabelLocalToc">