vault's People
vault's Issues
Remove the `secrets.pinged` column
App ping is mandatory for now.
The system does not work properly when installed in a subdirectory
(...)like installing it at
https://example.com/vault
instead of athttps//example.com
.
cc. @mdawaffe
Pass the unlock key implicitly in the unlock URL
This will remove the need of the HE to copy and paste the unlock key. The secret will be unlocked by just clicking on the URL.
Remove unused VaultClient::INSTRUCTIONS_ALLOWED_TAGS constant
`htmlspecialchars()` is a bit fragile without `ENT_QUOTES`
By default, htmlspecialchars()
only encodes double quotes. The views in vault only use double quotes in attributes, so it's not currently a problem, but the code is fragile: some future change might introduce a single quote.
Convert table "id" fields to the format "table_name_id"
Instructions/secret word wrap inconsistency
Instruction and secret textarea
input does not specify any word wrapping. Long lines being input in these fields are being displayed using pre-formated output, which causes the text to overflow and break the layout.
Schema Questions
References
I don't think MySQL accepts REFERENCES
outside of FOREIGN KEY
statements. Can you look into this?
Line 22 in 5455673
LogLevel
Is this table necessary? Seems like it might be over-normalization.
Add a note about greylisting in the email feedback messages
Add an 'unlock' call to the API
Ping URL must be mandatory
There's no point in having an app without a ping URL, because the app is responsible to notify engineers upon secret input, and it can only get to know this by being pinged by the Vault.
Fix app (when available) not being recorded in the logs
Add a `secret add` command to the CLI
XSS when displaying instructions to user.
HEs can XSS users by including event attributes in the the instructions markup.
<b onmouseover=alert(1)>Hover over this</b>
This isn't problematic now, but it's unclear what tools in the future may accept user input to pre-generate instructions.
Refactor logging -- separate general request logging from audit records
Inconsistent Entity Properties?
Why are some App
properties (key
, secret
, ...) assigned in the constructor and others (ping_url
) not?
Lines 13 to 18 in 5455673
The same question can be asked of several of the other classes. Is there some guiding principal about when to put something in the constructor, when to set properties manually, and when to offer a setter method?
I can't create any secrets
Lines 118 to 126 in 5455673
\DateTime::ISO8601
is not a valid datetime format according to MySQL.
[CRITICAL] www: exception 'PDOException' with message 'SQLSTATE[22007]: Invalid datetime format: 1292 Incorrect datetime value: '2016-03-03T07:34:08+00:00'
The +00:00
is what's breaking it for me. Changing the format to 'Y-m-d H:i:s'
works for me.
What version of MySQL are you using?
Why rethrow `ConfigException` in `Mailer`?
Lines 47 to 57 in 5455673
Could the message in ConfigException
be expanded, or is it better to rethrow a new VaultException
?
Document the API
Check persistent data constraints also in code
Add a prefix to database objects
Add a note about emails going to spam/junk folders
Vault emails can be diverted to junk/spam folders by email providers. A note about this should be added in the feedback messages.
`print` v. `echo`
Remove the confirmation step
Since the engineer is properly authenticated now, confirming the request is a unnecessary hurdle.
Increase default expire_answered_requests_after to 3 days
Merge client
Now that the system is more mature, it became more and more clear that merging the client app might a be a good idea:
- Just 1 package, instead of 2
- More easy to understand the whole system
- Thus potentially easier to deploy
- No loss of decoupling -- clients still communicate with the engine through API
Steps:
- Move app to
client/
folder - Move client-specific files in
lib/
- Check for common code
- Update documentation
Cc @mdawaffe
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. ๐๐๐
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google โค๏ธ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.