GitLab

Add secure_headers gem and config

See merge request !78

Update rack to 2.2.3

See merge request !81

This fixes CVE-2020-8184.

Due to the upgrade to Rails 5, formerly working installations which
served both HTTP (towards a Tor onion service) and HTTPS requests broke
due to mixed HTTP / HTTPS Origin headers and improved request forgery
protections.

A simple fix would be to enforce HTTPS within Rails. However, in a setup
as described, this would break the onion service.

Accordingly, this commit introduces a new gem, secure_headers, which
allows to do more fine-grained control of the involved settings. It
requires a reverse proxy like Apache or Nginx which sets
X-Forwarded-Proto for HTTPS requests, to make the backend aware.

This change is based on these docs:
https://riseup.net/en/security/network-security/tor/onionservices-best-practices#onion-services-and-rails-4

Ref #55

Bump websocket-extensions to 0.1.5

See merge request !80

Update rails and activeresource

See merge request !79

This fixes a few security vulnerabilities.

production: set log level to warn, instead of debug

Closes #115

See merge request !76

This way, IP addresses won't be logged, which is reasonable for a
software like schleuder-web. Also, this saves quite some space due to
the reduced logging. Still, if required, people are able to increase the
logging manually if there is a need to, or they prefer more verbose
logging in general.

Closes #115

Update rails (new patch-level).

See merge request !73

Mitigates a possible XSS vulnerability in ActionView (CVE-2020-5267).

Implement `deliver_selfsent`

Closes #112

See merge request !70

Update rack and nokogiri.

See merge request !71

3.5 is required for deliver_selfsent.

Wording for send_encrypted only.

See merge request !72

Some people misunderstand send_encrypted_only as applicable to all
emails that are being sent, not only to emails to subscribers. This
change in wording could help a little to avoid that.

Upgrade to Rails 5.x

See merge request !66

api uri helper

See merge request !69

with the previous patch it's possible that we don't need it anymore

With this patch we are now using configured api host and port instead of
`localhost`. This allow to use a container/vm for the API without
changing the config for the tests
With the stub_request...to_rack the `allow_localhost` option on WebMock
does not seems used

Fix rendering error message when list.key is not available

See merge request !68

When a key is not found ActiveResource::ResourceNotFound is raised as a
result a 404 is rendered because of `rescue_from` in the
application_controller.
With this patch we are returning nil so we can show the error defined on
_list_menu to the browser.

Relates !68

Relates !68

This comment might contain some changes that should have been included
in the one containing the update to rails 5.1, but unfortunately I can't
debug which those are.

The encrypted secrets feature is not used by schleuder-web, neither is
the built-in support for custom configuration.

I tried to migrate the configuration so that the behaviour of the
application doesn't change through the upgrades to 5.x.

Both ruby versions do not receive any updates anymore, so we may drop
them