GitLab

There was an HTML injection attack made possible by the fact that we
were including the unsanitized language inputs in the HTML page
returned to the user. This change filters any user-requested languages
(either from the Accept-Language header or the "lang" parameter) and
only includes languages supported by BridgeDB.

This reverts commit ff2cb23b.

Many translations got deleted by the update. We are reverting the update
and making a call for translators to get them reviewed for the next
release.

See #40013

Document how to use postfix as relay with an external account.

We don't follow the git workflow it anymore. We do use only main and
feature branches.

installTranslations expects a list, not a string.

Fixes #15404

Refactor the code to use email.message.EmailMessage instead of the custom
EmailResponse implementation.

Fixes #40008

Fixes #40011

I had to skip GimpCaptchaTests as the tests do run as root and this test
was checking that it didn't have permitions to read the file.

Fixes #40012

Fix for issue #27984

See merge request !14

Changed the hostname check by using verify_certificate_hostname from the service identity package for complete hostname verification.
Added wildcard certificates for testing and two additional test cases (test_verifyHostname_matching_wildcard & test_verifyHostname_matching_wildcard_multidns)

These descriptors are already validated by the Bridge Authority. Instead
of potentially DoS-ing ourselves, accept all descriptors but log an
error if stem validation fails.

If there was a faulty descriptor in the extrainfo document, Stem will
throw an exception and we loose the rest of the extrainfo descriptors
in the document. This passes extrainfo file objects to Stem so that if
an exception is raised on a single descriptor, the rest of the file can
be parsed starting at the file seek position.

Update instructions for creating mock bridges

See merge request !12

Update bridgedb-metrics spec to align with version 2 of the metrics format and...

See merge request !9

Update bridgedb-metrics spec to align with version 2 of the metrics
format and provide more information on internal metrics.

Only process text/plain part of emails.

See merge request !10

When our autoresponder receives a multipart email from a user, it may
get confused by the parts that are not text/plain.  Instead of bending
over backwards to parse all sorts email encodings, this patch discard
the parts of a multipart email that aren't text/plain.

This fixes #33835.

Issue 33647

See merge request !5

Running `make pylint` now works again.

This fixes issue #33647.

Signed-off-by: Philipp Winter <phw@nymity.ch>

Make BridgeDB export internal metrics.

See merge request !8

BridgeDB already exports usage metrics that help us understand how our
users interact with BridgeDB.  This commit adds internal metrics, which
shed light on BridgeDB's internals.  In particular, we add the following
internal metrics:

* Number of bridges per distributor subring.

* Number of empty responses per distributor.

* Number of IPv4/IPv6 handouts.

* Descriptive statistics on the number of bridge handouts (min, max,
  median, quartile 1, quartile 3, upper whisker, lower whisker).

* Number of unique bridges that were handed out.

This patch fixes #31422 and also bumps
BridgeDB's metrics format to version 2.

Parse bridge blocking info from SQL database.

See merge request !7

The plan currently is that wolpertinger will populate our SQL database
with bridge blocking info provided by OONI.  This patch adds code that
parses this data and adds it to our existing bridge objects.

This fixes #34260.

Remove coverage and pypi link; update Travis CI.

See merge request !6

Our Travis CI link still pointed to sysrqb's profile.  This commit
updates the link to use phw's profile.  I'm also removing the (outdated)
pypi and coverage links.

This fixes #40002.

Remove the --reload command line switch.

See merge request !4

This fixes #40001.