GithubHelp home page GithubHelp logo

softinux / base Goto Github PK

View Code? Open in Web Editor NEW
17.0 5.0 2.0 3.83 MB

Softinux Base is a framework to help you make ASP Net CORE web applications. Base is extension free. You must develop your extensions.

License: MIT License

C# 70.06% JavaScript 8.57% CSS 0.13% Batchfile 0.81% Shell 1.22% TypeScript 0.58% PowerShell 1.13% HTML 13.50% SCSS 4.00%
asp-net-core extcore-framework plugins modular asp-net-core-mvc net-core mvc-core aspnetcoremvc mvc aspnetcore

base's Introduction

Project overview

Build status Build Status Line of code Documentation Status Gitter chat License

SoftinuxBase is a free, open source, and cross-platform framework with built-in security access support and management for creating modular and extendable ASP.NET Core Core web applications.

It is built using ExtCore framework and the most modern tools and languages. Join our team!

⚠️ During the pre-alpha development phase, the issues are managed in our bug tracker ⚠️

Few Facts About SOFTINUX Base

  • It's free and open source.
  • It runs on Windows, MacOS and Linux.
  • It's completely modular and extendable. Using the features of the underlying ExtCore framework you can easily create your own extensions to extend its functionality.

Table of content

Basic Concepts

SoftinuxBase is a framework that looks like a .NET Core web application, but is intended to host mini web applications called extensions. Every extension will plug its content (pages, menu items) as well as security and authentication related items (permissions, roles, links...).

SoftinuxBase manages the common stuff so that the developer can focus on its extension and business logic, just having to provide what we call metadata to know how to display and authorize access to content, and use our version of Authorize attribute.

Read documentation to learn more about this.

Some screenshots of features:




License

Licensed under the MIT License. See LICENSE file for license information.

Getting started

Prerequisites

In order you must have installed:

Linux

To avoid error System.IO.IOException: The configured user limit (128) on the number of inotify instances has been reached. at System.IO.FileSystemWatcher.StartRaisingEvents() you must execute this command in terminal:

echo fs.inotify.max_user_instances=524288 | sudo tee -a /etc/sysctl.conf && sudo sysctl -p

Installation

1. Restore dependencies

Run npm i command so that dependencies packages are installed.

2. Restore nuget packages

Restore the nuGet packages is now an implicit command executed at application build. But you can still restore packages without building the application with the command dotnet restore in solution root folder.

3. Update database with migration

Go to src/WebApplication folder and run dotnet ef database update. This will create the database. See appsettings.json for database path. The Entity Framework database context is defined in web application's Startup.cs. We use Sqlite for development, but you can change this easily for another SGDB (see appsettings.json file).

4. Build the application

Go to the solution root folder and run bp.bat under Windows or bp.sh under Linux/MacOS. (use -h for help). This is the quick way. Some commands from bp.bat/bp.sh are also used by PreBuild and PostBuild events but this may not work for all IDEs.

5. Run the app

Go to src/WebApplication folder and type dotnet run. If you prefer, you can also execute this command from solution root folder: dotnet run --project src\WebApplication\WebApplication.csproj (Beware of the path if you are on Linux/MacOS).

After that, the application is available on http://localhost:5000/ or https://localhost:5001/

ℹ️ Information About Visual Studio 2017 ℹ️

If you launched application from Visual Studio, this port will change, being randomly defined, and value is stored in src/WebApplication/Properties/launchSettings.json You can edit this value in Visual Studio: WebApplication's properties > Debug tab > Web Server Settings/App URL or directly in launchSettings.json file. After, the default port used by dotnet run is the port defined in src/WebApplication/Properties/launchSettings.json.

ℹ️ Information About Rider 2017.3 ℹ️

Rider 2017.3 cannot execute the PostBuild event declared in src/WebApplication.csproj. You need to execute ./bp.sh copyexts and ./bp.sh copydeps after building the solution or project. Or refer to our documentation to see how to configure external tools that will be launched by build process.

6. Add the first user (demo user)

With Postman (or the program of your choice) make a POST request to this url: http://localhost:5000/dev/seed/create-user With command line:

  • using curl: curl -i -X POST http://localhost:5000/dev/seed/create-user -d "Content-Length: 0"
  • using powershell: Invoke-WebRequest -Uri http://localhost:5000/dev/seed/create-user -Method POST

This will create the demo user with general permissions.

7. Login with demo user

user: [email protected] (or johndoe) password: 123_Password (password is case sensitive)

Implement your own extension

⚠️ You cannot place your Extensions folder to another drive. See #2981

You can use Visual Studio 2017, Visual Studio Code or JetBrains Rider to make your own extension. If you decide to use Visual Studio, be aware that projects are not compatible with Visual Studio 2015.

Add a new project

Using command-line (easy and cross-platform):

dotnet new classlib -o <you_new_project>

Add project reference to the solution

Go to solution folder and type:

dotnet add reference <path_to_your_new_project>

Write your code

In your new project, create a class that implements SoftinuxBase.Infrastructure.IExtensionMetadata.

Your extension will depend on SoftinuxBase.Infrastructure.

Have a look at sample extensions, wiki, feel free to open issues for questions.

Code coverage

We give simple code covering with coverlet coverage. But to use it with Visual Studio Code, you need two extensions:

.NET Test Explorer configuration

If you want code coverage automatically in .NET Test Explorer, you must configure dotnet-test-explorer.testArguments and add /p:CollectCoverage=true /p:CoverletOutputFormat=lcov /p:CoverletOutput=./lcov.info in text field.

Configuratrion by Json value :

"dotnet-test-explorer.testArguments": "/p:CollectCoverage=true /p:CoverletOutputFormat=lcov /p:CoverletOutput=./lcov.info"

We also provide many test watchers script in TestWatchesr folders.

⚠️ Don't forget to add "coverlet" package in your tests projets.

Watchers

If you have the error :

System.IO.IOException: The configured user limit (128) on the number of inotify instances has been reached, or the per-process limit on the number of open file descriptors has been reached.

Execute:

  • Ubuntu, Debian and derivativbe: echo fs.inotify.max_user_watches=524288 | sudo tee -a /etc/sysctl.conf && sudo sysctl -p
  • Macos:

Browsers support


IE / Edge

Firefox

Chrome

Safari

Opera
IE11, Edge last 10 versions last 10 versions last 10 versions last 10 versions

Using Visual Studio Code For Developing

If you prefer to use Visual Studio Code, you need these extensions:

Very recommended for this project

Optional for better experience:

At your discretion:

We also provide the tasks.json and launch.json configuration for Visual studio Code.

base's People

Contributors

dependabot[bot] avatar mend-bolt-for-github[bot] avatar postb99 avatar xarkam avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar

base's Issues

CVE-2015-9251 (Medium) detected in jquery-1.8.3-2.0.0.min.js, jquery-1.9.1.min.js

CVE-2015-9251 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-1.8.3-2.0.0.min.js, jquery-1.9.1.min.js

jquery-1.8.3-2.0.0.min.js

Flat UI Free is a beautiful theme for Bootstrap. We have redesigned many of its components to look flat in every pixel

Library home page: https://cdnjs.cloudflare.com/ajax/libs/flat-ui/2.0.0/js/jquery-1.8.3.min.js

Path to dependency file: /tmp/ws-scm/Base/node_modules/icheck/demo/index.html

Path to vulnerable library: /Base/node_modules/icheck/demo/./js/jquery.js

Dependency Hierarchy:

  • jquery-1.8.3-2.0.0.min.js (Vulnerable Library)
jquery-1.9.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/jquery.min.js

Path to dependency file: /tmp/ws-scm/Base/node_modules/toastr/demo.html

Path to vulnerable library: /Base/node_modules/toastr/demo.html

Dependency Hierarchy:

  • jquery-1.9.1.min.js (Vulnerable Library)

Found in HEAD commit: f95650d7ec47991b82522b7dcf91deaeacb87460

Vulnerability Details

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

Publish Date: 2018-01-18

URL: CVE-2015-9251

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-9251

Release Date: 2018-01-18

Fix Resolution: jQuery - v3.0.0


Step up your Open Source Security Game with WhiteSource here

Enable or disable registration for new users

Allow to activate or not the registration of new users.

Or via the json configuration. This will require a restart of the application if the value is changed.

Either via the database.

CVE-2018-14041 (Medium) detected in bootstrap-4.1.0.min.js

CVE-2018-14041 - Medium Severity Vulnerability

Vulnerable Library - bootstrap-4.1.0.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.1.0/js/bootstrap.min.js

Path to dependency file: /tmp/ws-scm/Base/node_modules/daterangepicker/index.html

Path to vulnerable library: /Base/node_modules/daterangepicker/index.html

Dependency Hierarchy:

  • bootstrap-4.1.0.min.js (Vulnerable Library)

Found in HEAD commit: f95650d7ec47991b82522b7dcf91deaeacb87460

Vulnerability Details

In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.

Publish Date: 2018-07-13

URL: CVE-2018-14041

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: twbs/bootstrap#26630

Release Date: 2018-07-13

Fix Resolution: org.webjars.npm:bootstrap:4.1.2.org.webjars:bootstrap:4.1.2


Step up your Open Source Security Game with WhiteSource here

CVE-2018-14042 (Medium) detected in bootstrap-4.1.0.min.js

CVE-2018-14042 - Medium Severity Vulnerability

Vulnerable Library - bootstrap-4.1.0.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.1.0/js/bootstrap.min.js

Path to dependency file: /tmp/ws-scm/Base/node_modules/daterangepicker/index.html

Path to vulnerable library: /Base/node_modules/daterangepicker/index.html

Dependency Hierarchy:

  • bootstrap-4.1.0.min.js (Vulnerable Library)

Found in HEAD commit: f95650d7ec47991b82522b7dcf91deaeacb87460

Vulnerability Details

In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.

Publish Date: 2018-07-13

URL: CVE-2018-14042

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: twbs/bootstrap#26630

Release Date: 2018-07-13

Fix Resolution: org.webjars.npm:bootstrap:4.1.2.org.webjars:bootstrap:3.4.0


Step up your Open Source Security Game with WhiteSource here

CVE-2018-14040 (Medium) detected in bootstrap-4.1.0.min.js

CVE-2018-14040 - Medium Severity Vulnerability

Vulnerable Library - bootstrap-4.1.0.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.1.0/js/bootstrap.min.js

Path to dependency file: /tmp/ws-scm/Base/node_modules/daterangepicker/index.html

Path to vulnerable library: /Base/node_modules/daterangepicker/index.html

Dependency Hierarchy:

  • bootstrap-4.1.0.min.js (Vulnerable Library)

Found in HEAD commit: f95650d7ec47991b82522b7dcf91deaeacb87460

Vulnerability Details

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.

Publish Date: 2018-07-13

URL: CVE-2018-14040

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: twbs/bootstrap#26630

Release Date: 2018-07-13

Fix Resolution: org.webjars.npm:bootstrap:4.1.2,org.webjars:bootstrap:3.4.0


Step up your Open Source Security Game with WhiteSource here

WS-2019-0017 (Medium) detected in clean-css-3.4.28.tgz

WS-2019-0017 - Medium Severity Vulnerability

Vulnerable Library - clean-css-3.4.28.tgz

A well-tested CSS minifier

Library home page: https://registry.npmjs.org/clean-css/-/clean-css-3.4.28.tgz

Path to dependency file: /tmp/ws-scm/Base/package.json

Path to vulnerable library: /tmp/ws-scm/Base/node_modules/clean-css/package.json

Dependency Hierarchy:

  • gulp-cssmin-0.2.0.tgz (Root Library)
    • clean-css-3.4.28.tgz (Vulnerable Library)

Found in HEAD commit: f95650d7ec47991b82522b7dcf91deaeacb87460

Vulnerability Details

Version of clean-css prior to 4.1.11 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.

Publish Date: 2018-03-06

URL: WS-2019-0017

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/785

Release Date: 2019-02-21

Fix Resolution: v4.1.11


Step up your Open Source Security Game with WhiteSource here

Minified javascript/Release mode: cannot access "n" before initialization

Describe the bug
As time of writing, the culprit code sits on NewPermissionsSystem-Admin branch. This branch may have been merged to master or deleted at your time of reading.

Minified javascript throws "cannot access 'n' before initialization" error when you click in a dropdown list that is enhanced with Select2.

To Reproduce
Steps to reproduce the behavior:

  1. Build the application in Release mode. See our documentation to seed your local database.

  2. Login as johndoe.

  3. In main menu, click on 'Main' in section 'Administration'.

  4. Click on 'Grant Global Permissions'.

  5. Choose a value in the dropdown below "View assigned permissions for:"

  6. There is a popup with javascript error.
    image

  7. At the right of screen, the assigned permissions look all messy.
    image
    They should rather display this way: a list of disabled Select2 dropdowns:
    image

Expected behavior
Minified javascript should not throw an error, since non minified javascript works well (build the application in Debug mode).

Screenshots
See above

Environment:

  • OS: Windows 10
  • Browser: MS Edge, Chrome
  • Version: latest

Additional context
Help wished!

CVE-2020-11022 (Medium) detected in multiple libraries

CVE-2020-11022 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-1.8.3-2.0.0.min.js, jquery-3.3.1.js, jquery-1.9.1.min.js

jquery-1.8.3-2.0.0.min.js

Flat UI Free is a beautiful theme for Bootstrap. We have redesigned many of its components to look flat in every pixel

Library home page: https://cdnjs.cloudflare.com/ajax/libs/flat-ui/2.0.0/js/jquery-1.8.3.min.js

Path to dependency file: /tmp/ws-scm/Base/node_modules/icheck/demo/index.html

Path to vulnerable library: /Base/node_modules/icheck/demo/./js/jquery.js

Dependency Hierarchy:

  • jquery-1.8.3-2.0.0.min.js (Vulnerable Library)
jquery-3.3.1.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.js

Path to dependency file: /tmp/ws-scm/Base/node_modules/daterangepicker/demo.html

Path to vulnerable library: /Base/node_modules/daterangepicker/demo.html

Dependency Hierarchy:

  • jquery-3.3.1.js (Vulnerable Library)
jquery-1.9.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/jquery.min.js

Path to dependency file: /tmp/ws-scm/Base/node_modules/toastr/demo.html

Path to vulnerable library: /Base/node_modules/toastr/demo.html

Dependency Hierarchy:

  • jquery-1.9.1.min.js (Vulnerable Library)

Found in HEAD commit: f95650d7ec47991b82522b7dcf91deaeacb87460

Vulnerability Details

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11022

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

Release Date: 2020-04-29

Fix Resolution: jQuery - 3.5.0


Step up your Open Source Security Game with WhiteSource here

Permissions design proposition

Here is a design proposal for the permissions management part.

The idea is to have a table with one row per extension. When clicking a row, the row unfolds to display a nested table which contains one row per role and in each row, a select2 containing all the permissions assigned to the role and allowing them to be managed.

image.png

CVE-2019-8331 (Medium) detected in bootstrap-4.1.0.min.js

CVE-2019-8331 - Medium Severity Vulnerability

Vulnerable Library - bootstrap-4.1.0.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.1.0/js/bootstrap.min.js

Path to dependency file: /tmp/ws-scm/Base/node_modules/daterangepicker/index.html

Path to vulnerable library: /Base/node_modules/daterangepicker/index.html

Dependency Hierarchy:

  • bootstrap-4.1.0.min.js (Vulnerable Library)

Found in HEAD commit: f95650d7ec47991b82522b7dcf91deaeacb87460

Vulnerability Details

In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.

Publish Date: 2019-02-20

URL: CVE-2019-8331

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: twbs/bootstrap#28236

Release Date: 2019-02-20

Fix Resolution: bootstrap - 3.4.1,4.3.1;bootstrap-sass - 3.4.1,4.3.1


Step up your Open Source Security Game with WhiteSource here

Users management

Topics :

  • login
  • new user registration
  • editing his profile
  • editing of profiles by the admin

Important information about toolboxes: in Security.Tools, and the class is called Verb + Object, for example RegisterUser or CreateRole

To write in the form of a story:

  • user deletion / user role modification: check if a user has the Admin permission of its own, and if none have it, check if a user must have a role that has this permission. This user cannot have this role removed or deleted. Messages should be precise.

CVE-2020-11023 (Medium) detected in multiple libraries

CVE-2020-11023 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-3.3.1.js, jquery-1.9.1.min.js, jquery-3.3.1.slim.min.js

jquery-3.3.1.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.js

Path to dependency file: /tmp/ws-scm/Base/node_modules/daterangepicker/demo.html

Path to vulnerable library: /Base/node_modules/daterangepicker/demo.html

Dependency Hierarchy:

  • jquery-3.3.1.js (Vulnerable Library)
jquery-1.9.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/jquery.min.js

Path to dependency file: /tmp/ws-scm/Base/node_modules/toastr/demo.html

Path to vulnerable library: /Base/node_modules/toastr/demo.html

Dependency Hierarchy:

  • jquery-1.9.1.min.js (Vulnerable Library)
jquery-3.3.1.slim.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.slim.min.js

Path to dependency file: /tmp/ws-scm/Base/node_modules/select2-theme-bootstrap4/docs/_includes/scripts.html

Path to vulnerable library: /Base/node_modules/select2-theme-bootstrap4/docs/_includes/scripts.html,/Base/node_modules/daterangepicker/index.html

Dependency Hierarchy:

  • jquery-3.3.1.slim.min.js (Vulnerable Library)

Found in HEAD commit: f95650d7ec47991b82522b7dcf91deaeacb87460

Vulnerability Details

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11023

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11023

Release Date: 2020-04-29

Fix Resolution: jquery - 3.5.0


Step up your Open Source Security Game with WhiteSource here

CVE-2019-11358 (Medium) detected in jquery-3.3.1.js, jquery-1.9.1.min.js

CVE-2019-11358 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-3.3.1.js, jquery-1.9.1.min.js

jquery-3.3.1.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.js

Path to dependency file: /tmp/ws-scm/Base/node_modules/daterangepicker/demo.html

Path to vulnerable library: /Base/node_modules/daterangepicker/demo.html

Dependency Hierarchy:

  • jquery-3.3.1.js (Vulnerable Library)
jquery-1.9.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/jquery.min.js

Path to dependency file: /tmp/ws-scm/Base/node_modules/toastr/demo.html

Path to vulnerable library: /Base/node_modules/toastr/demo.html

Dependency Hierarchy:

  • jquery-1.9.1.min.js (Vulnerable Library)

Found in HEAD commit: f95650d7ec47991b82522b7dcf91deaeacb87460

Vulnerability Details

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

Publish Date: 2019-04-20

URL: CVE-2019-11358

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358

Release Date: 2019-04-20

Fix Resolution: 3.4.0


Step up your Open Source Security Game with WhiteSource here

CVE-2012-6708 (Medium) detected in jquery-1.8.3-2.0.0.min.js

CVE-2012-6708 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.8.3-2.0.0.min.js

Flat UI Free is a beautiful theme for Bootstrap. We have redesigned many of its components to look flat in every pixel

Library home page: https://cdnjs.cloudflare.com/ajax/libs/flat-ui/2.0.0/js/jquery-1.8.3.min.js

Path to dependency file: /tmp/ws-scm/Base/node_modules/icheck/demo/index.html

Path to vulnerable library: /Base/node_modules/icheck/demo/./js/jquery.js

Dependency Hierarchy:

  • jquery-1.8.3-2.0.0.min.js (Vulnerable Library)

Found in HEAD commit: f95650d7ec47991b82522b7dcf91deaeacb87460

Vulnerability Details

jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.

Publish Date: 2018-01-18

URL: CVE-2012-6708

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2012-6708

Release Date: 2018-01-18

Fix Resolution: jQuery - v1.9.0


Step up your Open Source Security Game with WhiteSource here

Logo Proposal

Hello! I was just reading through your project and I'd like to contribute to it by designing a logo. If you'd want that too, please let me know if there are any specific things you'd want this logo to represent, and if you don't have any I'll just implement my own ideas. Looking forward to hearing from you :)

Active or inactive user: existing code to adjust

As part of the management of roles / permissions, we have requests that make a join on the link of the role or permission to the user.

Typically queries that determine if "there is a user with own Admin permission" or "there is a role with Admin permission for extension X".

In these two queries, you must exclude non-active users:

  • account not yet activated
  • blocked account
  • see if we have planned other cases.

So add a join on the AspNetUsers table with a condition in the "on" of the join.

Location of the code concerned:

  • AspNetRolesRepository Method FindHavingUsers
  • UserPermissionRepository Method FindBy (string extensionName_, Common.Enums.Permission level_). Be careful, you will have to complete this method by passing for example a bool activeUsersOnly to false by default.

As it is necessary to complete the functional analysis relating to the management of users and their particularities (not yet active, blocked ...), this modification falls within the scope of this epic since the users cannot be modified beforehand.

Info: LockoutEnabled field to true in the User WIF = blocked account.

""*Undefined*"bp.bat generateBareboneCss"

Describe the bug
error MSB3073: La commande ""Undefined"bp.bat generateBareboneCss" s'est arrêtée avec le code 9009.

To Reproduce
Steps to reproduce the behavior:

  1. dotnet build in directory WebApplication

Screenshots
image

Desktop

  • OS: [Windows NT]

dotnet ef database update build failed

Environment data

dotnet --info output:
.NET Core SDK (reflecting any global.json):
Version: 2.2.202
Commit: 8a7ff6789d

Runtime Environment:
OS Name: Windows
OS Version: 10.0.17134
OS Platform: Windows
RID: win10-x64
Base Path: C:\Program Files\dotnet\sdk\2.2.202\

Host (useful for support):
Version: 2.2.3
Commit: 6b8ad509b6

.NET Core SDKs installed:
1.0.0-preview2-1-003177 [C:\Program Files\dotnet\sdk]
1.0.0-rc4-004771 [C:\Program Files\dotnet\sdk]
1.0.0 [C:\Program Files\dotnet\sdk]
1.0.4 [C:\Program Files\dotnet\sdk]
1.1.0 [C:\Program Files\dotnet\sdk]
2.0.0-preview1-005977 [C:\Program Files\dotnet\sdk]
2.0.0 [C:\Program Files\dotnet\sdk]
2.0.2 [C:\Program Files\dotnet\sdk]
2.1.202 [C:\Program Files\dotnet\sdk]
2.1.302 [C:\Program Files\dotnet\sdk]
2.1.401 [C:\Program Files\dotnet\sdk]
2.1.602 [C:\Program Files\dotnet\sdk]
2.2.202 [C:\Program Files\dotnet\sdk]

.NET Core runtimes installed:
Microsoft.AspNetCore.All 2.1.2 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
Microsoft.AspNetCore.All 2.1.9 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
Microsoft.AspNetCore.All 2.2.3 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
Microsoft.AspNetCore.App 2.1.2 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 2.1.9 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 2.2.3 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.NETCore.App 1.0.3 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 1.0.4 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 1.0.5 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 1.1.0 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 1.1.1 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 1.1.2 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 2.0.0-preview1-002111-00 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 2.0.0 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 2.0.9 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 2.1.2 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 2.1.3-servicing-26724-03 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 2.1.9 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 2.2.3 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]

Steps to reproduce

after cloning the project, installing the bundle with npm successfully, the probleme comes when am supposed to create the database in the WebApplication project running the command "dotnet ef database update" the build failed

Expected behavior

the migration supposed to work according to the Docs

Actual behavior

the build fails

Editing your own profile

To discuss.

Idea: after creating your account, or later.

Different from profile editing by admin. For example: the admin can change the UserName, but the user cannot, he can change his Email etc.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.