(#11365) Rigorously escape user inputs (CVE-2012-0891)

This fix addresses a bug in Puppet Dashboard versions 1.0 – 1.2.4 that allows
for Cross Site Scripting (XSS) attacks on certain input fields. This could
potentially allow a malicious user to share Puppet Dashboard data with other
websites, or manipulate fields in the Dashboard database.  This commit
sanitizes user inputs to avoid the aforementioned XSS attacks and also
updates the jquery tokeninput library to resist XSS attacks.
(#11365) Rigorously escape user inputs (CVE-2012-0891)

This fix addresses a bug in Puppet Dashboard versions 1.0 – 1.2.4 that allows
for Cross Site Scripting (XSS) attacks on certain input fields. This could
potentially allow a malicious user to share Puppet Dashboard data with other
websites, or manipulate fields in the Dashboard database.  This commit
sanitizes user inputs to avoid the aforementioned XSS attacks and also
updates the jquery tokeninput library to resist XSS attacks.
(#12440) Add config flag to puppet-dashboard file in rh spec

Without this commit, the installer for dashboard treats the
/etc/sysconfig/puppet-dashboard config file as a regular file
and overwrites it during install, even if it already exists
and has been modified.  This patch marks puppet-dashboard in
the spec file as a config file, so that if it exists on the
install target and is modified, the original version is preserved.
($12440) Add additional config file to spec file

Without this commit, the /etc/logrotate.d/puppet-dashboard
file is overwritten during install, even if it exists and
has been modified. This patch flags the logrotate.d/puppet-dashboard
file as a config file, so that if it exists on the install
target and is modified, the original version is preserved.

Signed-off-by: Moses Mendoza moses@puppetlabs.com
(#12153) Adds list of supported browsers to README.markdown
Merge pull request #85 from djsauble2/12153_supported_browsers

(#12153) Adds list of supported browsers to README.markdown
(#12440) change config behavior for logrotate.d/puppet-dashboard

This patch modifies the rpm behavior with respect to
logrotate.d/puppet-dashboard, marking it as a standard config
file without the noreplace tag. Without this modification,
if a puppet install were to require install of a new
puppet-dashboard logrotate file, any user mods of the previous
version would prevent the installation, instead causing the new
config file to be installed as <config>.rpmnew.

This patch changes the behavior to instead install the new
config file by default, and save the previous file (if edited)
as <config>.rpmsave.

Signed-off-by: Moses Mendoza <moses@puppetlabs.com>
Add read-only access control hooks for Rack middleware

Prior to this commit, Dashboard could be put into a read-only mode by
setting a flag in a configuration file. This commit extends this
ability to Rack middleware. Specfically, Rack middleware can put
Dashboard into read-only mode by declaring something like:

env['rack.session']['ACCESS_CONTROL_ROLE'] = 'READ_ONLY'

Prior to this commit, there were no tests for the read-only
configuration flag. This commit adds tests for both methods of making
Dashboard read-only. All tests pass. In addition, both read-only
methods have been tested in a live environment.
(#12484) Strips whitespace from parameter keys

Parameter keys for groups and nodes aren't allowed to have
trailing spaces. This commit adds a filter before validation
that strips these spaces.
(#12658) Add robots.txt to dashboard

Without this patch, in the default install of puppet dashboard,
internet bots can crawl and index puppet dashboard sites.
This patch adds a robots.txt file to dashboard that prevents
crawling by all bot types of the whole site.

Signed-off-by: Moses Mendoza <moses@puppetlabs.com>
Merge pull request #88 from MosesMendoza/Ticket/master/12658_add_robots.txt

(#12658) Add robots.txt to dashboard
Merge pull request #86 from djsauble2/12484_strip_whitespace

(#12484) Strips whitespace from parameter keys
Merge pull request #84 from MosesMendoza/Ticket/master/12440_mark_config_in_spec_file

(#12440) Add config flag to puppet-dashboard file in rh spec
Merge pull request #87 from lifton/feature/master/rack-middleware-read-only

Add read-only access control hooks for Rack middleware

Reviewed by Jeff McCune <jeff@puppetlabs.com>
Merging 1.2rc into master
Merge pull request #89 from djsauble2/master

Merging 1.2rc into master
Updated CHANGELOG for 1.2.6rc1
Merge branch '1.2rc' of github.com:puppetlabs/puppet-dashboard into 1.2rc
Updating CHANGELOG for 1.2.6
Add parameters support for nodes and node groups

Previous to this commit there was no rake API for setting parameters on
nodes and node groups.  This commit adds the `node:parameters` and
`nodegroup:parameters` tasks. Both accept two arguments:
- *name* Which node or node group to apply the parameters to
- *parameters* In format param1=val,param2=val2

This format was chosen for two reasons. I wanted multiple parameters to
be
able to supported on a single command. Further, rake doesn't support
multiple instances of the same argument so a format such as
'parameter=param,value parameter=param2,value2' could not be supported.

Example:
`rake node:parameters name=master.puppet.internal \
parameters=ntpserver=ntp1.mydomain.com,dnsserver=dns.mydomain.com`

Potential Issues:
Currently it is impossible to escape the *=* or *,* characters when
specifying the parameters value.  So node or node group parameters that
include a comma or equal sign will not be able to be specified.