webui: fix potential XSS vulnerabilities

Escape user defined text to prevent XSS attacks. Extra precaution was taken
to escape also parts which are unlikely to contain user-defined text.

fixes CVE-2014-7850

https://fedorahosted.org/freeipa/ticket/4742

Reviewed-By: Tomas Babej <tbabej@redhat.com>
Raise right exception if domain name is not valid

Because of dnspython implementation, in some cases UnicodeError is
raised instead of DNS SyntaxError

Ticket: https://fedorahosted.org/freeipa/ticket/4734
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
Add additional backup & restore checks

https://fedorahosted.org/freeipa/ticket/3893

Reviewed-By: Martin Basti <mbasti@redhat.com>
Restore file extended attributes and SELinux context in ipa-restore

https://fedorahosted.org/freeipa/ticket/4712

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
restore: clear httpd ccache after restore

so that httpd ccache won't contain old credentials which would make ipa CLI fail with error:

 Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure.  Minor code may provide more information (Decrypt integrity check failed)

https://fedorahosted.org/freeipa/ticket/4726

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
Fix pk11helper module compiler warnings

Ticket: https://fedorahosted.org/freeipa/ticket/4657
Reviewed-By: David Kupka <dkupka@redhat.com>
Fix --{user,group}-ignore-attribute in migration plugin.

Ignore case in attribute names.

https://fedorahosted.org/freeipa/ticket/4620

Reviewed-By: Martin Basti <mbasti@redhat.com>
Fix filtering of enctypes in server code.

The filtering was incorrect and would result in always discarding all values.
Also make sure there are no duplicates in the list.

Partial fix for:
https://fedorahosted.org/freeipa/ticket/4718

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
Add asn1c generated code for keytab controls

Instead of manually encoding controls, use an actual asn1 compiler.
The file asn1/asn1c/ipa.asn1 will contain ipa modules. The generated code
is committed to the tree and built into a static library that is linked
to the code that uses it.

The first module implements the GetKeytabControl control.

Related:
https://fedorahosted.org/freeipa/ticket/4718
https://fedorahosted.org/freeipa/ticket/4728

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
Use asn1c helpers to encode/decode the getkeytab control

Replaces manual encoding with automatically generated code.

Fixes:
https://fedorahosted.org/freeipa/ticket/4718
https://fedorahosted.org/freeipa/ticket/4728

Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
Fix: read_ip_addresses should return ipaddr object

Interactive prompt callback returns list of str instead of CheckedIPAddress
instances.

Ticket: https://fedorahosted.org/freeipa/ticket/4747
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
tests: Use PEP8-compliant setup/teardown method names

The setUp/dearDown names are used in the unittest module, but there is no reason
to use them in non-`unittest` test cases.
Nose supports both styles (but mixing them can cause trouble when
calling super()'s methods).
Pytest only supports the new ones.

https://fedorahosted.org/freeipa/ticket/4610

Reviewed-By: Tomas Babej <tbabej@redhat.com>
tests: Add configuration for pytest

By default, pytest considers test classes only if they're named
'Test*'; Nose also allows 'test_*'.
Configure pytest to allow the non-pep8 names as well.

https://fedorahosted.org/freeipa/ticket/4610

Reviewed-By: Tomas Babej <tbabej@redhat.com>
ipatests.util.ClassChecker: Raise AttributeError in get_subcls

Pytest considers NotImplementedError on attribute access an error.

https://fedorahosted.org/freeipa/ticket/4610

Reviewed-By: Tomas Babej <tbabej@redhat.com>
test_automount_plugin: Fix test ordering

Nose ran the `test_a_*` and `test_a2_*` tests in opposite order
than the source suggested. Fix this.

https://fedorahosted.org/freeipa/ticket/4610

Reviewed-By: Tomas Babej <tbabej@redhat.com>
Use setup_class/teardown_class in Declarative tests

Pytest will consider each Declarative test individually, running
setup/teardown for each one.
Move the setup and teardown to the class level.

https://fedorahosted.org/freeipa/ticket/4610

Reviewed-By: Tomas Babej <tbabej@redhat.com>
dogtag plugin: Don't use doctest syntax for non-doctest examples

https://fedorahosted.org/freeipa/ticket/4610

Reviewed-By: Tomas Babej <tbabej@redhat.com>
test_webui: Don't use __init__ for test classes

https://fedorahosted.org/freeipa/ticket/4610

Reviewed-By: Tomas Babej <tbabej@redhat.com>
test_ipapython: Use functions instead of classes in test generators

pytest's support for Nose-style test generators is not bulletproof;
use a real function to please it.

https://fedorahosted.org/freeipa/ticket/4610

Reviewed-By: Tomas Babej <tbabej@redhat.com>
Configure pytest to run doctests

The pytest.ini file needs to be in or above the directory py.test is called in.
When in IPA project root, this invocation will find ./ipatests/pytest.ini:
    py.test ipatests/
but these will not (they're equivalent):
    py.test .
    py.test
So pytest.ini must be in the project root.

However, setupttols can't include files outside package directories,
so we also need this file to be under ipatests/

Solve the problem by symlinking ./pytest.ini to ipatests/pytest.ini.

https://fedorahosted.org/freeipa/ticket/4610

Reviewed-By: Tomas Babej <tbabej@redhat.com>