🚨 [security] [src/api - 2.9] Update loofah: 2.2.2 → 2.2.3 (patch)

Fix xml output for comments

This prevents the creation of a comment with the null character, that
would make the comment invalid for xml output.

Co-authored-by: Victor Pereira <vpereira@suse.com>

Prevent the xml renderer from throwing a 500 internal server error:

ActionView::Template::Error (string contains null byte)

Co-authored-by: Victor Pereira <vpereira@suse.com>

Broken with commit 30334760

Prevent creation of a request with an ID attribute

Co-authored-by: David Kang <dkang@suse.com>

This makes possible to add validations of the parsed xml in the
controller.

A bunch of us have talked about what the content of good commit meesages should
look like and came up with this template.

So you can switch branches without producing untracked files.

Commit afed7d40 fixed a
problem causing endless rebuilds but introduced a new bug
causing endless rebuilds in other corner cases. That's
why I hate messing with the gen_meta code, it's impossible
to test all corner cases.

It was different to the implementation in perl-BSSolv, leading
to endless rebuilds in some rare cases.

Deleting it by timestamp is too dangerous, as the assumption that
the API fetches the payload right after fetching the notification
event is no longer valid. So disable automatic pruning and rely
on the API doing manual delete requests.

It supports a project or url prefix as argument

[Security] Bump ffi from 1.9.18 to 1.9.25 in /src/api

Bumps [ffi](https://github.com/ffi/ffi) from 1.9.18 to 1.9.25. **This update includes security fixes.**
- [Release notes](https://github.com/ffi/ffi/releases)
- [Changelog](https://github.com/ffi/ffi/blob/master/CHANGELOG.md)
- [Commits](https://github.com/ffi/ffi/compare/1.9.18...1.9.25

)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Disable notifications for Travis

Fix repository URL for running TravisCI

On 2.9 branch this was pointing to Unstable. This caused not to find
packages already deleted in Unstable, and TravisCI to fail.

Fix link 2 9

This is needed to address CVE-2018-3760.

  https://groups.google.com/forum/#!topic/rubyonrails-security/ft_J--l55fM

This is needed because the target package could have been deleted
after the previous check_action_permission! call.

Forwarded requests are made from projects that just have been updated.
It doesn't make sense to update or clean them up once the forwarded
request got updated.

Add test case for bsc#1098934.

Co-authored-by: David Kang <dkang@suse.com>

When a source project links to another project and the request is using
the sourceupdate option, we have to ensure that the requester has
permissions to change the linked project.

Kudos goes to @marcus-h (Marcus Hüwe) for finding this ugly bug.

Co-authored-by: David Kang <dkang@suse.com>

* Allow adding a linked project to project factories
* Use a valid project config xml file to store in the backend

Co-authored-by: David Kang <dkang@suse.com>

We have a couple of code pathes in OBS that operate on both,
projects and packages. So we end up many times having to check whether
we have to run a permission check on an a project or package.

This commit adds a method that calls can_modify_package? or
can_modify_project? depending on the given object class.

Co-authored-by: Adrian Schröter <adrian@suse.de>
Co-authored-by: Michael Schroeder <mls@suse.de>

This could happen when the worker was started from some other
directory than the statedir and the statedir had an up-to-date
copy of the worker code.