Commit Graph

55 Commits

Author SHA1 Message Date
PelleK
d886bc2eba
Cleanup code to python 3.6 (#342)
* Cleanup setup.py

* remove explicit inheritance from object

* convert most string interpolations to f-strings

Co-authored-by: Pelle Koster <pelle.koster@nginfra.nl>
2020-10-07 20:45:51 -05:00
PelleK
8101cf9192
Run black on codebase (#336)
* run black on codebase

* add black check to travis ci

* add pyproject.toml, revert black on bottle.py

Co-authored-by: Pelle Koster <pelle.koster@nginfra.nl>
2020-10-05 21:04:22 -05:00
PelleK
8b1979031e
Log messages to stdout instead of stderr (#334)
* log to stdout

* add stdout logging to config and test it

* remove non-implemented parameter from docs

* configure log stream based on config, somehow this change got lost

* fix unittests for other python versions

* option to specify log stream

* Be more explicit in usage text

Co-authored-by: Matthew Planchard <mplanchard@users.noreply.github.com>

* remove redundant arguments

* be more consistent in usage text

* add test for disabling stream logging

* fix side-effect of unittests

Co-authored-by: Matthew Planchard <mplanchard@users.noreply.github.com>
2020-10-03 16:30:49 -05:00
Géry Ogam
dbee4ec4ce Update welcome.html (#278)
* Update welcome.html

* Update test_app.py
2019-11-10 17:40:13 -06:00
Matthew Planchard
205342049b
[268] Ensure remove_pkg removes all pkg instances (#273)
* [268] Ensure remove_pkg removes all pkg instances

Reported by @esciara in #268.

Previously, the `remove_pkg` command was only removing the first
matching package that it found so if, for example, there were a .tar.gz
file and a .whl file, it would only remove one of them.

Of course, it could be run in succession to accomplish full removal, but
the expected behavior is that removal will remove the package entirely.

Here, I've grouped `remove_pkg` related tests into a test class, added
some tests that verify the expected behavior, and updated the
`remove_pkg` method to remove all matching packages.

* CHANGES.rst
2019-09-17 21:30:30 -05:00
Matthew Planchard
a52c0d6f4c
fmt: tests/test_app.py 2019-09-17 20:29:48 -05:00
Matthew Planchard
91a5ebd8b1
[#265] Resolve issue with non-md5 hashing algorithms (#266) 2019-09-02 14:31:59 -05:00
swe-jaeyoungpark
c3965e31a0 fix typos on test_app.py 2019-05-02 23:14:31 +09:00
swe-jaeyoungpark
8a196ddc90 add test cases with X_FORWARDED_HOST header 2019-04-29 18:22:35 +09:00
Matthew Planchard
1375a67c55 CRLF Injection Mitigation
Resolves #237

Previously, we were not running any sort of URL escaping on values
passed in from the client that were used for redirects. This allowed
injection attacks via URL encoded newlines in the original request.

This update ensures that all user-supplied paths that are used as
components of redirects are passed through `urllib.parse.quote()`
(or the python 2 equivalent) prior to being used in a redirect
response.

Also specified 127.0.0.1 rather than 0.0.0.0 (the default) in server
tests to avoid triggering firewall dialogs when testing on MacOS
2019-01-24 17:53:03 -06:00
Matthew Planchard
2499dac8ec Merge branch 'rm-3.3' of git://github.com/hugovk/pypiserver into hugovk-rm-3.3 2018-06-12 20:26:31 -05:00
Matthew Planchard
c791d12292 FIX: Fallback URL, remove calls to pip.main
Resolves #205 - pypi.python.org shutting down

* Updated the default fallback URL to `pypi.org/simple` rather than
`pypi.python.org/simple`
* Scrubbed references and links to `pypi.python.org`
* Fixed tests breaking due to the removal of `pip.main()` in pip 10.0 -
see pypa/pip#5080 for more info
2018-06-11 20:31:03 -05:00
Hugo
676e86d683 Remove redundant parentheses 2018-05-07 22:29:36 +03:00
Hugo
31a5b5d7e7 Replace function call with set literal 2018-05-07 22:29:36 +03:00
Matthew Planchard
c0b93bdaef Revert Matrix Auth
This reverts commits 29c1803 c79dd18 568f901 and 3d37c00. This has
resulted in bugs referenced in #175, #179, and #186.
2017-11-14 08:43:49 -06:00
Matthew Planchard
05f5920c25 Updated Default Fallback URL to https
Resolves #179

Due to a pypi API change (reasoning
[here](https://mail.python.org/pipermail/distutils-sig/2017-October/031712.html),
thanks to @natefoo for the link), the redirect links that we were
generating for distributions not present in the package index were
failing with `403` errors.

@ankostis, I have not had time to look into why the standalone tests are
failing. Perhaps we should just ignore them in order to get a new
version out once this is merged to master?
2017-10-31 12:34:22 -05:00
Jordan Speicher
519c195253 Default fallback_url to use HTTPS
`pypi.python.org/simple` will respond to HTTP requests with `403: SSL is required.`

This will change the default fallback_url to use HTTPS.  This should fix #179.
2017-10-26 12:44:05 -05:00
Kyle Hornberg
3d37c00999 Add matrix auth 2017-02-21 16:29:47 -06:00
Matthew Planchard
7aa9240391 Merge pull request #114 from blade2005/topic/allow-search-with-pip
Topic/allow search with pip
2016-06-22 21:11:01 -05:00
Dana Powers
1f6da1fe00 Implement PEP 503 Package Name Normalization and URL Redirects 2016-05-19 15:45:08 -07:00
Matthew Planchard
b9b95713b4 Test for search functionality
Removed unused imports
Added docstrings
Whitespace changes
PEP 008 compliance
Added test for search
2016-05-12 19:44:24 -05:00
bibby
54247a17bb test_upload_with_signature fix to allow uploaded files in any order. My result appears different than the expected outcome. 2016-04-21 08:08:18 -07:00
Kostis Anagnostopoulos
140796bb6e gpg, #106, test: Add upload+sig TC.
- Rename upload-file vars in /upload action.
2016-01-19 18:50:14 +01:00
Kostis Anagnostopoulos
ab2f170fe9 Rework package parsing.
+ FIX #104: Stopped parsing invalid package-versions prefixed with `v`;
  they are invalid according to :pep-reference:`0440`.
+ Also support versions with epochs separated by `!` like `package-1!1.1.0`.
+ Move bottle-filename check on app module.
2016-01-19 13:36:16 +01:00
Kostis Anagnostopoulos
4527573a50 app: Improve server-response error-messages.
+ test: Parametrize remove-pkg TCs.
2016-01-19 13:36:09 +01:00
ankostis on tokoti
6b904db6c5 FIX #102: uploading pkgs with +! chars in version.
+ Use `content.raw_filename` for allowing PEP0440 chars.
+ Add upload app-TCs.
+ Improve parse-pkg core-TC.
+ Update CHANGES on forthcomming release.
2016-01-17 22:47:00 +01:00
ankostis on tokoti
011c79b8bf init: Use locals() in configure() to avoid explicitly listing **kwds.
+ Update CHANGES.
2015-12-21 03:01:16 +02:00
ankostis on tokoti
85e51d5a48 FIX #53: Append MD5 url-fragments on package links.
- TC only for digest-method.
2015-12-20 02:32:45 +02:00
Kostis Anagnostopoulos
e32ca3425b Add test_server TCs with twine<-->real process.
+ TC for #82 uploading `dentodeps` package with 200 deps.
2015-09-17 20:04:00 +02:00
ankostis on tokoti
133afe28f7 Rework standalone generation using ZIP.
+ Standalone executable based on wheel.
+ Properly use `pkg_resources` so reading `welcome-msg` file
  works even from within zip.
  + Mark `zip_safe=True` in setup.py.
+ Delete forgotten distutils startup script.
+ Build standalone before installing anything else,
  to check if any deps are missing.
+ Restore py25 in Travis.
2015-09-17 01:13:37 +02:00
Kostis Anagnostopoulos at STUW025
2c1ceb04b5 Restructure main to allow for gevent monkeypatch (FIX #49).
+ Update zip and setuptools startup-cripts.
2015-09-15 22:22:09 +02:00
ankostis on tokoti
d50cdb6c3b docs: Update github-links, suitable python-versions, changes and
rel-date.

- Update maintainers.
- Update python-classifiers.
- Various README edits.
- #38: Update suggestion on welcome-file.
- Add ankostis to authors (so Ralf may avoid half harassment for
this release).
2015-02-28 01:21:48 +01:00
ankostis on tokoti
10f42e829c xss: Generate all index-listings with SimpleTemplate instead of
string-substs (#see 77).

- Add titles<h1> in all index-listings.
- FIX unicode errors on new TC's of prev commit.
2015-02-23 03:14:19 +01:00
ankostis on tokoti
7cc36aee0c Improve welcome-msg tests and add XSS for when removing packages
(probably not needed).
2015-02-23 01:45:35 +01:00
Kostis Anagnostopoulos, Yoga-2
cb6f3b698a Use bottle's SimpleTemplate engine to avoid XSS on welcome-page (#77).
- Add 1 TC.
- TODO: Probable XSS still in error-messages.
2015-02-22 18:43:35 +01:00
Bartek Rychlicki
c3453878f1 Add tests for cache control. 2015-02-17 00:30:53 +01:00
ankostis@kilo
c64b8c32d2 Allow to override welcome-msg(/) from a separate html file.
- Read welcome-msg in UTF-8.
- Add cmd-line option for `welcome-file`.
- Add TCs for welcome-file option and `/` http-req.
- Update docs for new option.
- Failback to in-code welcome-msg if unreadable (ie standalone mode, bad file).
2015-01-15 16:20:24 +01:00
ankostis@kilo
cf03226ea2 Add Logging for all http actions.
* Use stabdard python's logging lib.
* Log http-request/response/errors.
* Cmd-line options for logging-format and filename.
* Cmd-line options for request /response/error requests/responses/errors
props to log.
* Add `-v` option controlling verbosity.
* Add docs about new options.
* TCs only `-v` & `--log_file ` (logging statements used throughout all
tests).
2014-11-17 16:51:45 +01:00
Ralf Schmitt
ab599f98f1 add a test for a package that uses both _ and - 2013-04-02 22:07:08 +02:00
Eliot
7ad9e2afd1 Remove duplicates from "/simple" index page
The main line repo
(c1b9386dff)
currently lists duplicate entries on the "/simple" index page if the
package name contains hyphens and if both a source file and egg file are
uploaded. One index entry contains hyphens in the name which matches the
source file name and the other entry contains underscores in the name
which matches the egg file. Clicking both links lead to pages which list
the same files (both the source file and the egg file).

The previous fix
(c6966afeed)
mostly fixed this problem but it did not account for package names that
included an underscore. Change the "/simple" index to use the name from
a non-egg file, since this name should not have hyphens converted to
underscores as egg files do. If there are only egg files, use the egg
file name.
2013-04-01 16:49:15 -07:00
Ralf Schmitt
7a999fb8cb test that root view returns absolute paths in hrefs
this is github issue 25
2012-12-02 23:07:48 +01:00
Ralf Schmitt
6989d316c5 use webtest instead of twill
webtest works with python 3.

we now also get rid of paste and pastedeploy and use
bottle.Bottle.mount instead.
2012-12-02 01:17:55 +01:00
Ralf Schmitt
2f2eeee593 use new pytest.fixture functionality 2012-11-26 22:25:30 +01:00
Ralf Schmitt
81571c60a3 use pypiserver.app factory function in test_app 2012-04-07 23:10:49 +02:00
Ralf Schmitt
1b2f37ede5 do not use the default bottle app 2012-04-07 22:57:40 +02:00
Ralf Schmitt
c0f82470c6 move bottle app function to _app module
I'd like to run multiple pypiserver wsgi apps inside one process and
plan to do so by reloading pypiserver._app.

this is the first step. we move all of the @route'd functions to _app.
2012-04-07 22:30:54 +02:00
Ralf Schmitt
e7cf0e1d7f use paste to test non-root installations 2012-04-03 22:59:01 +02:00
Ralf Schmitt
b680e34527 test that directories starting with a dot are ignored 2011-10-07 20:39:52 +02:00
Ralf Schmitt
219497b555 test for 404 when we don't have a package 2011-09-01 01:38:22 +02:00
Ralf Schmitt
16684872d0 cleanup with twill.remove_wsgi_intercept 2011-09-01 01:08:32 +02:00