internlm/SWE-Fixer-Train-110K huggingface dataset:
Repository: Netflix/lemur

Issue:
Minor Comment Stdout Issues in InitializeApp()



Discussion:

Resolving patch:
diff --git a/lemur/manage.py b/lemur/manage.py
--- a/lemur/manage.py
+++ b/lemur/manage.py
@@ -208,16 +208,16 @@ def run(self, password):
         if operator_role:
             sys.stdout.write("[-] Operator role already created, skipping...!\n")
         else:
-            # we create an admin role
+            # we create an operator role
             operator_role = role_service.create('operator', description='This is the Lemur operator role.')
             sys.stdout.write("[+] Created 'operator' role\n")
 
         read_only_role = role_service.get_by_name('read-only')
 
         if read_only_role:
-            sys.stdout.write("[-] Operator role already created, skipping...!\n")
+            sys.stdout.write("[-] Read only role already created, skipping...!\n")
         else:
-            # we create an admin role
+            # we create an read only role
             read_only_role = role_service.create('read-only', description='This is the Lemur read only role.')
             sys.stdout.write("[+] Created 'read-only' role\n")
 


Test patch:
Repository: Netflix/lemur

Issue:
Variable Name Printed Instead of Value
https://github.com/Netflix/lemur/blob/e09b7eb97860b69e40493b3eb528e57e823dba30/lemur/manage.py#L241


Discussion:

Resolving patch:
diff --git a/lemur/manage.py b/lemur/manage.py
--- a/lemur/manage.py
+++ b/lemur/manage.py
@@ -237,9 +237,6 @@ def run(self, password):
         else:
             sys.stdout.write("[-] Default user has already been created, skipping...!\n")
 
-        sys.stdout.write("[+] Creating expiration email notifications!\n")
-        sys.stdout.write("[!] Using {0} as specified by LEMUR_SECURITY_TEAM_EMAIL for notifications\n".format("LEMUR_SECURITY_TEAM_EMAIL"))
-
         intervals = current_app.config.get("LEMUR_DEFAULT_EXPIRATION_NOTIFICATION_INTERVALS", [])
         sys.stdout.write(
             "[!] Creating {num} notifications for {intervals} days as specified by LEMUR_DEFAULT_EXPIRATION_NOTIFICATION_INTERVALS\n".format(
@@ -249,6 +246,8 @@ def run(self, password):
         )
 
         recipients = current_app.config.get('LEMUR_SECURITY_TEAM_EMAIL')
+        sys.stdout.write("[+] Creating expiration email notifications!\n")
+        sys.stdout.write("[!] Using {0} as specified by LEMUR_SECURITY_TEAM_EMAIL for notifications\n".format(recipients))
         notification_service.create_default_expiration_notifications("DEFAULT_SECURITY", recipients=recipients)
 
         _DEFAULT_ROTATION_INTERVAL = 'default'


Test patch:
Repository: Netflix/lemur

Issue:
Lemur Ignores -c Option
When starting lemur with -c (ex: `lemur start -c /etc/lemur.conf.py`), the value passed into -c is silently ignored.


Discussion:
Looks similar to #1887 have you tried `--config`? Could be just the sort name not being parsed.
Just tested with `--config`, same result. The only way that I can get it to use the config file is to have it in `~/.lemur/lemur.cfg.py` (or symlink the config file to that location).

Interestingly, if the file passed to `-c` or `--config` is not readable due to permissions, lemur will die because it failed to read the config file... so at some point it is attempting to at least open the configuration file  passed in on the command line. It is not actually using the settings in that file though, only the one in the users home directory.

Resolving patch:
diff --git a/lemur/__init__.py b/lemur/__init__.py
--- a/lemur/__init__.py
+++ b/lemur/__init__.py
@@ -62,8 +62,8 @@
 )
 
 
-def create_app(config=None):
-    app = factory.create_app(app_name=__name__, blueprints=LEMUR_BLUEPRINTS, config=config)
+def create_app(config_path=None):
+    app = factory.create_app(app_name=__name__, blueprints=LEMUR_BLUEPRINTS, config=config_path)
     configure_hook(app)
     return app
 
diff --git a/lemur/manage.py b/lemur/manage.py
--- a/lemur/manage.py
+++ b/lemur/manage.py
@@ -50,7 +50,7 @@
 from lemur.dns_providers.models import DnsProvider  # noqa
 
 manager = Manager(create_app)
-manager.add_option('-c', '--config', dest='config')
+manager.add_option('-c', '--config', dest='config_path', required=False)
 
 migrate = Migrate(create_app)
 
@@ -391,7 +391,7 @@ def run(self, *args, **kwargs):
         # run startup tasks on an app like object
         validate_conf(current_app, REQUIRED_VARIABLES)
 
-        app.app_uri = 'lemur:create_app(config="{0}")'.format(current_app.config.get('CONFIG_PATH'))
+        app.app_uri = 'lemur:create_app(config_path="{0}")'.format(current_app.config.get('CONFIG_PATH'))
 
         return app.run()
 


Test patch:
diff --git a/lemur/tests/conftest.py b/lemur/tests/conftest.py
--- a/lemur/tests/conftest.py
+++ b/lemur/tests/conftest.py
@@ -43,7 +43,7 @@ def app(request):
     Creates a new Flask application for a test duration.
     Uses application factory `create_app`.
     """
-    _app = create_app(os.path.dirname(os.path.realpath(__file__)) + '/conf.py')
+    _app = create_app(config_path=os.path.dirname(os.path.realpath(__file__)) + '/conf.py')
     ctx = _app.app_context()
     ctx.push()
Repository: Netflix/lemur

Issue:
DNS Providers list doesn't  show type
In the DNS Providers list, there is a column for the provider type, but it's always empty.

Looking at the code, and the API requests, the issue seems to be with the dns_providers API call, which returns the list of all providers.

There should be a providerType value in the JSON, but it's not there. 

A quick glance at the `DnsProvidersNestedOutputSchema` shows that the value is called `providerType`, but in the database the field is called `provider_type` similar to `api_endpoint` which is called `api_endpoint` in the OutputSchema, so I guess, it's probably just mislabeled in the OutputSchema, and needs to be adjusted there, and maybe in the angular template.


Discussion:

Resolving patch:
diff --git a/lemur/dns_providers/schemas.py b/lemur/dns_providers/schemas.py
--- a/lemur/dns_providers/schemas.py
+++ b/lemur/dns_providers/schemas.py
@@ -8,7 +8,7 @@ class DnsProvidersNestedOutputSchema(LemurOutputSchema):
     __envelope__ = False
     id = fields.Integer()
     name = fields.String()
-    providerType = fields.String()
+    provider_type = fields.String()
     description = fields.String()
     credentials = fields.String()
     api_endpoint = fields.String()


Test patch:
Repository: Netflix/lemur

Issue:
ACME Revoke Failed
'AcmeDnsHandler' object has no attribute 'acme'
Traceback (most recent call last):
  File "/opt/lemur/lemur/common/schema.py", line 160, in decorated_function
    resp = f(*args, **kwargs)
  File "/opt/lemur/lemur/certificates/views.py", line 1444, in put
    plugin.revoke_certificate(cert, data)
  File "/opt/lemur/lemur/plugins/lemur_acme/plugin.py", line 272, in revoke_certificate
    return self.acme.revoke_certificate(certificate)
  File "/opt/lemur/lemur/plugins/lemur_acme/acme_handlers.py", line 227, in revoke_certificate
    acme_client, _ = self.acme.setup_acme_client(certificate.authority)
AttributeError: 'AcmeDnsHandler' object has no attribute 'acme'

This works if the function call:
 acme_client, _ = self.setup_acme_client(certificate.authority)


Discussion:
I'll look into this, I have a decent idea what  I messed up while refactoring.

I should probably also add tests for the certificate revocation.

Resolving patch:
diff --git a/lemur/plugins/lemur_acme/acme_handlers.py b/lemur/plugins/lemur_acme/acme_handlers.py
--- a/lemur/plugins/lemur_acme/acme_handlers.py
+++ b/lemur/plugins/lemur_acme/acme_handlers.py
@@ -224,7 +224,7 @@ def get_domains(self, options):
     def revoke_certificate(self, certificate):
         if not self.reuse_account(certificate.authority):
             raise InvalidConfiguration("There is no ACME account saved, unable to revoke the certificate.")
-        acme_client, _ = self.acme.setup_acme_client(certificate.authority)
+        acme_client, _ = self.setup_acme_client(certificate.authority)
 
         fullchain_com = jose.ComparableX509(
             OpenSSL.crypto.load_certificate(


Test patch:
Repository: Netflix/lemur

Issue:
Google authentication fails when legacy people API is disabled
When using OAuth credentials generated under a developer project with the [legacy people API](https://developers.google.com/people/legacy) enabled, Lemur will fail to retrieve the user's e-mail address from the user info endpoint:

```
{'error': {'code': 403, 'message': 'Legacy People API has not been used in project 35982982159 before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/legacypeople.googleapis.com/overview?project=35982982159 then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.', 'status': 'PERMISSION_DENIED', 'details': [{'@type': 'type.googleapis.com/google.rpc.Help', 'links': [{'description': 'Google developers console API activation', 'url': 'https://console.developers.google.com/apis/api/legacypeople.googleapis.com/overview?project=35982982159'}]}, {'@type': 'type.googleapis.com/google.rpc.ErrorInfo', 'reason': 'SERVICE_DISABLED', 'domain': 'googleapis.com', 'metadata': {'service': 'legacypeople.googleapis.com', 'consumer': 'projects/35982982159'}}]}}
```

It seems that it would need to be updated to use the newer [People API](https://developers.google.com/people/api/rest/v1/people/get) to circumvent this issue.

Unfortunately, it looks like once the legacy People API is disabled it cannot be re-enabled again so there's not a lot of available workarounds.


Discussion:

Resolving patch:
diff --git a/lemur/auth/views.py b/lemur/auth/views.py
--- a/lemur/auth/views.py
+++ b/lemur/auth/views.py
@@ -564,7 +564,7 @@ def __init__(self):
 
     def post(self):
         access_token_url = "https://accounts.google.com/o/oauth2/token"
-        people_api_url = "https://www.googleapis.com/plus/v1/people/me/openIdConnect"
+        user_info_url = "https://www.googleapis.com/oauth2/v1/userinfo"
 
         self.reqparse.add_argument("clientId", type=str, required=True, location="json")
         self.reqparse.add_argument(
@@ -581,6 +581,7 @@ def post(self):
             "redirect_uri": args["redirectUri"],
             "code": args["code"],
             "client_secret": current_app.config.get("GOOGLE_SECRET"),
+            "scope": "email",
         }
 
         r = requests.post(access_token_url, data=payload)
@@ -589,7 +590,7 @@ def post(self):
         # Step 2. Retrieve information about the current user
         headers = {"Authorization": "Bearer {0}".format(token["access_token"])}
 
-        r = requests.get(people_api_url, headers=headers)
+        r = requests.get(user_info_url, headers=headers)
         profile = r.json()
 
         user = user_service.get_by_email(profile["email"])


Test patch:
Repository: Netflix/lemur

Issue:
Support emitting logs to stdout
**Context**
We currently deploy Lemur in a containerized environment and would like to have Lemur emit JSON logs to `stdout` instead of in a rotating log file. Our reason is that it is generally regarded as a best practice when running in a container to write all logs to stdout and have the orchestrator do the collection. This is something we really embrace in our company and our tooling is built with this assumption in mind.

**Issue**
We tried configuring Lemur with `LOG_FILE = "/dev/stdout"` but the `RotatingFileHandler` throws an exception when attempting a `os.seek(...)`  on the file descriptor. Unstructured logs are already emitted on `stderr` but that unfortunately doesn't address our need since splitting those logs is essentially impossible.


Discussion:

Resolving patch:
diff --git a/lemur/factory.py b/lemur/factory.py
--- a/lemur/factory.py
+++ b/lemur/factory.py
@@ -15,6 +15,7 @@
 import errno
 import pkg_resources
 import socket
+import stat
 
 from logging import Formatter, StreamHandler
 from logging.handlers import RotatingFileHandler
@@ -193,9 +194,14 @@ def configure_logging(app):
 
     :param app:
     """
-    handler = RotatingFileHandler(
-        app.config.get("LOG_FILE", "lemur.log"), maxBytes=10000000, backupCount=100
-    )
+    logfile = app.config.get("LOG_FILE", "lemur.log")
+    # if the log file is a character special device file (ie. stdout/stderr),
+    # file rotation will not work and must be disabled.
+    disable_file_rotation = os.path.exists(logfile) and stat.S_ISCHR(os.stat(logfile).st_mode)
+    if disable_file_rotation:
+        handler = StreamHandler(open(logfile, 'a'))
+    else:
+        handler = RotatingFileHandler(logfile, maxBytes=10000000, backupCount=100)
 
     handler.setFormatter(
         Formatter(


Test patch:
Repository: Netflix/lemur

Issue:
Metric reporting task fails if there are no other active celery tasks
When the `report_celery_last_success_metrics` task is run, it will [check if it's already running](https://github.com/Netflix/lemur/blob/master/lemur/common/celery.py#L139), and if so, skip the task execution. However, if there are no other active tasks being executed by Celery, this check fails and an exception is raised as shown below.

```
{'function': 'lemur.common.celery.report_failed_task', 'Message': 'Celery Task Failure', 'traceback': 'Traceback (most recent call last):
  File "/opt/venv/lib/python3.8/site-packages/celery/app/trace.py", line 385, in trace_task
    R = retval = fun(*args, **kwargs)
  File "/opt/lemur/lemur/common/celery.py", line 62, in __call__
    return TaskBase.__call__(self, *args, **kwargs)
  File "/opt/venv/lib/python3.8/site-packages/celery/app/trace.py", line 650, in __protected_call__
    return self.run(*args, **kwargs)
  File "/opt/lemur/lemur/common/celery.py", line 140, in report_celery_last_success_metrics
    if task_id and is_task_active(function, task_id, None):
  File "/opt/lemur/lemur/common/celery.py", line 79, in is_task_active
    for _, tasks in active_tasks.items():
AttributeError: \'NoneType\' object has no attribute \'items\'
', 'task_name': 'lemur.common.celery.report_celery_last_success_metrics', 'task_id': '5de894e1-2445-48bd-bfbf-50692e302c51', 'sender_hostname': 'gen1@lemur-ffd76664-s4jd4', 'receiver_hostname': 'celery@lemur-ffd76664-s4jd4', 'error': 'AttributeError("\'NoneType\' object has no attribute \'items\'")'}
```


Discussion:

Resolving patch:
diff --git a/lemur/common/celery.py b/lemur/common/celery.py
--- a/lemur/common/celery.py
+++ b/lemur/common/celery.py
@@ -75,6 +75,8 @@ def is_task_active(fun, task_id, args):
 
     i = inspect()
     active_tasks = i.active()
+    if active_tasks is None:
+        return False
     for _, tasks in active_tasks.items():
         for task in tasks:
             if task.get("id") == task_id:


Test patch:
Repository: Netflix/lemur

Issue:
Session timeout can be reduced
Currently the JWT Session Token currently has an excessive session timeout. The length of the timeout can be reduced to lower the risk of an attacker gaining access.

If a user leaves their computer unattended, a nearby attacker could access the user’s computer and any open applications. Automatically logging a user out after an extended period of inactivity can limit the time that an attacker could make use of any hijacked sessions.

References:
[OWASP's Session Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html)
[OWASP's Page on Session Timeout](https://owasp.org/www-community/Session_Timeout)

---

The referenced issue was found via a pen test conducted in collaboration with [Infor](https://www.infor.com/) and [Cobalt.io](https://www.cobalt.io/)


Discussion:

Resolving patch:
diff --git a/lemur/auth/service.py b/lemur/auth/service.py
--- a/lemur/auth/service.py
+++ b/lemur/auth/service.py
@@ -8,27 +8,23 @@
 .. moduleauthor:: Kevin Glisson <kglisson@netflix.com>
 
 """
-import jwt
 import json
-import binascii
-
-from functools import wraps
 from datetime import datetime, timedelta
+from functools import wraps
 
-from flask import g, current_app, jsonify, request
-
-from flask_restful import Resource
-from flask_principal import identity_loaded, RoleNeed, UserNeed
-
-from flask_principal import Identity, identity_changed
-
+import binascii
+import jwt
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives import serialization
 from cryptography.hazmat.primitives.asymmetric.rsa import RSAPublicNumbers
+from flask import g, current_app, jsonify, request
+from flask_principal import Identity, identity_changed
+from flask_principal import identity_loaded, RoleNeed, UserNeed
+from flask_restful import Resource
 
-from lemur.users import service as user_service
 from lemur.api_keys import service as api_key_service
 from lemur.auth.permissions import AuthorityCreatorNeed, RoleMemberNeed
+from lemur.users import service as user_service
 
 
 def get_rsa_public_key(n, e):
@@ -57,9 +53,21 @@ def create_token(user, aid=None, ttl=None):
     :param user:
     :return:
     """
-    expiration_delta = timedelta(
-        days=int(current_app.config.get("LEMUR_TOKEN_EXPIRATION", 1))
-    )
+    expiration_delta = timedelta(days=1)
+    custom_expiry = current_app.config.get("LEMUR_TOKEN_EXPIRATION")
+    if custom_expiry:
+        if isinstance(custom_expiry, str) and custom_expiry.endswith("m"):
+            expiration_delta = timedelta(
+                minutes=int(custom_expiry.rstrip("m"))
+            )
+        elif isinstance(custom_expiry, str) and custom_expiry.endswith("h"):
+            expiration_delta = timedelta(
+                hours=int(custom_expiry.rstrip("h"))
+            )
+        else:
+            expiration_delta = timedelta(
+                days=int(custom_expiry)
+            )
     payload = {"iat": datetime.utcnow(), "exp": datetime.utcnow() + expiration_delta}
 
     # Handle Just a User ID & User Object.


Test patch:
Repository: Netflix/lemur

Issue:
Missing option to change user password
It should be possible to change the user password after the user has been created.
I noticed that changing the `LEMUR_ADMIN_PASSWORD` after the database had been initialised, did not change the lemur user password.


Discussion:

Resolving patch:
diff --git a/lemur/users/service.py b/lemur/users/service.py
--- a/lemur/users/service.py
+++ b/lemur/users/service.py
@@ -13,7 +13,6 @@
 from lemur.logs import service as log_service
 from lemur.users.models import User
 
-
 STRICT_ENFORCEMENT_DEFAULT_ROLES = ["admin", "operator", "read-only"]
 
 
@@ -46,7 +45,7 @@ def create(username, password, email, active, profile_picture, roles):
     return database.create(user)
 
 
-def update(user_id, username, email, active, profile_picture, roles):
+def update(user_id, username, email, active, profile_picture, roles, password=None):
     """
     Updates an existing user
 
@@ -56,6 +55,7 @@ def update(user_id, username, email, active, profile_picture, roles):
     :param active:
     :param profile_picture:
     :param roles:
+    :param password:
     :return:
     """
     strict_role_enforcement = current_app.config.get("LEMUR_STRICT_ROLE_ENFORCEMENT", False)
@@ -68,6 +68,8 @@ def update(user_id, username, email, active, profile_picture, roles):
     user.email = email
     user.active = active
     user.profile_picture = profile_picture
+    if password:
+        user.password = password
     update_roles(user, roles)
 
     log_service.audit_log("update_user", username, f"Updating user with id {user_id}")
diff --git a/lemur/users/views.py b/lemur/users/views.py
--- a/lemur/users/views.py
+++ b/lemur/users/views.py
@@ -8,23 +8,19 @@
 from flask import g, Blueprint
 from flask_restful import reqparse, Api
 
-from lemur.common.schema import validate_schema
-from lemur.common.utils import paginated_parser
-
-from lemur.auth.service import AuthenticatedResource
 from lemur.auth.permissions import admin_permission
-
-from lemur.users import service
+from lemur.auth.service import AuthenticatedResource
 from lemur.certificates import service as certificate_service
+from lemur.common.schema import validate_schema
+from lemur.common.utils import paginated_parser
 from lemur.roles import service as role_service
-
+from lemur.users import service
 from lemur.users.schemas import (
     user_input_schema,
     user_output_schema,
     users_output_schema,
 )
 
-
 mod = Blueprint("users", __name__)
 api = Api(mod)
 
@@ -282,6 +278,7 @@ def put(self, user_id, data=None):
             data["active"],
             None,
             data["roles"],
+            data.get("password")
         )
 
 


Test patch:
Repository: doccano/doccano

Issue:
[Tiny enhancement request] Allow digit keys as shortkeys
Feature description
---------
English letters are allowed as shortkeys for annotation now, only.

Proposition: allow English letters and digits as shortkeys.


Discussion:
OK.

Resolving patch:
diff --git a/app/api/models.py b/app/api/models.py
--- a/app/api/models.py
+++ b/app/api/models.py
@@ -150,7 +150,7 @@ class Label(models.Model):
         ('ctrl shift', 'ctrl shift')
     )
     SUFFIX_KEYS = tuple(
-        (c, c) for c in string.ascii_lowercase
+        (c, c) for c in string.digits + string.ascii_lowercase
     )
 
     text = models.CharField(max_length=100)


Test patch:
Repository: doccano/doccano

Issue:
CORS error when running locally in development mode
How to reproduce the behaviour
---------
1. `git clone https://github.com/doccano/doccano.git`
2. `cd doccano`
3. `docker-compose -f docker-compose.dev.yml up`
4. Visit `http://localhost:3000/auth`
5. Login with user `admin` and password `password`

Your Environment
---------
*   Operating System: macOS Catalina 10.15.3
*   Browser: Chrome 80.0.3987.163 (Official Build) (64-bit)

What Happens
---------

I get a CORS error and I can't login:

```
Access to XMLHttpRequest at 'http://127.0.0.1:8000/v1/auth-token' from origin 'http://localhost:3000' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
```

![image](https://user-images.githubusercontent.com/566418/79062242-599a1500-7c66-11ea-92fc-13036d2eb88b.png)

Here is what the Request Headers look like:

![image](https://user-images.githubusercontent.com/566418/79062248-73d3f300-7c66-11ea-80d6-a2eb3a39122b.png)



Discussion:

Resolving patch:
diff --git a/app/app/settings.py b/app/app/settings.py
--- a/app/app/settings.py
+++ b/app/app/settings.py
@@ -314,4 +314,5 @@
     CORS_ORIGIN_WHITELIST = (
         'http://127.0.0.1:3000',
         'http://0.0.0.0:3000',
+        'http://localhost:3000'
     )


Test patch: