CLIENT IP / SPOOFABILITY. docs/geenforce-api-cutover.md claimed that removing the IIS rewrite rule made the allowlist fail closed and that it does NOT become spoofable. The opposite is true. IIS never sets X-Forwarded-For on its own; the rule is the only thing that does. Remove it and IIS still forwards whatever X-Forwarded-For the CALLER sent, waitress trusts it because it arrives from 127.0.0.1, and remote_addr becomes attacker-controlled - so a token-less caller can fetch manifests from anywhere on the network. The document and the _trusted_client_ip docstring now say so, waitress runs with --trusted-proxy-count=1, and stage 5 checks the rule is actually live rather than assuming it. The wizard question is rephrased to something an operator can verify with their network team instead of guessing at. NON-ASCII. The style gate only ever checked .py/.vue/.js/.ts, so documentation accumulated em-dashes, arrows and box-drawing characters against this repo's own convention - including in files added this week. Cleaned, and the gate now uses INCLUDES_ALL so Markdown, JSON and YAML are covered. PLUGIN DEFAULTS. The wizard pre-ticked measuringtools and printedparts, both of which ship default_enabled=false, so every site taking the defaults installed and enabled them against their manifests. Inno has no JSON parser so the list must be hardcoded, but tests/test_installer_defaults.py now fails when it drifts. UPGRADES. The payload copy merges, so a plugin dropped from a site's profile kept its code forever - which defeats a lean build and leaves core's optional-import guards succeeding for a plugin the site no longer has. Stale plugin directories are now deregistered and removed before the copy. add-plugin used 'plugin install', which for the five default_enabled=false plugins left them installed but DISABLED - and printed a green success line anyway. It now goes through apply-profile, and the success line is gated on the exit code. Invoke-Flask records its own exit status, because $LASTEXITCODE keeps a stale value when flask.exe is missing and no native command runs. CHARSET. The utf8mb4 compiler hook lived inline in migrations/env.py, so it covered the CORE chain only: plugin baselines inherited the server default, which on a latin1 server means two charsets in one database. It is now shopdb/utils/mysql_charset.py, imported by both, and preflight reports the database's default charset. BACKUP HONESTY. The dump was described as 'all of your asset data'. Uploaded branding and floor-map images live in instance\ on disk, not in the database, so a restore from the .sql alone comes back with no map. backup now archives instance\ alongside it and says both are needed. VERSIONING. AppVersion was hardcoded at 0.9.0 while the product, the frontend and the newest tag said 0.7.0 - and 0.9.0 collides with a retired contract version. Both builders now generate version.iss from shopdb/__init__.py. Smaller: rollback overwrites .env before deleting it, as uninstall already did; appcmd unlocks are scoped to this site's location rather than server-wide, with the wide unlock as a fallback; DEVELOPMENT-SETUP says Python 3.14; the README plugin list gains printedparts; prune-schema --force is documented as first-provisioning-only; HTTPS is documented as not-the-default with the steps to add it; the DBA SQL is on the wizard's database page; the features page says unticking does not remove an installed feature; and the installer README states that bundle-lock cannot vouch for the exe itself - that needs signing or an out-of-band hash, neither of which is wired up.
155 lines
5.4 KiB
Python
155 lines
5.4 KiB
Python
import logging
|
|
from logging.config import fileConfig
|
|
|
|
from flask import current_app
|
|
|
|
from alembic import context
|
|
|
|
# Registers the compiler hook that forces utf8mb4 + DYNAMIC on MySQL. Imported
|
|
# for the side effect, and shared with the PLUGIN chains via
|
|
# shopdb/plugins/alembic_template.py - it used to live here, so it covered core
|
|
# only and plugin baselines inherited the server default charset.
|
|
import shopdb.utils.mysql_charset # noqa: F401
|
|
|
|
# this is the Alembic Config object, which provides
|
|
# access to the values within the .ini file in use.
|
|
config = context.config
|
|
|
|
# Interpret the config file for Python logging.
|
|
# This line sets up loggers basically.
|
|
fileConfig(config.config_file_name)
|
|
logger = logging.getLogger('alembic.env')
|
|
|
|
|
|
def get_engine():
|
|
try:
|
|
# this works with Flask-SQLAlchemy<3 and Alchemical
|
|
return current_app.extensions['migrate'].db.get_engine()
|
|
except (TypeError, AttributeError):
|
|
# this works with Flask-SQLAlchemy>=3
|
|
return current_app.extensions['migrate'].db.engine
|
|
|
|
|
|
def get_engine_url():
|
|
try:
|
|
return get_engine().url.render_as_string(hide_password=False).replace(
|
|
'%', '%%')
|
|
except AttributeError:
|
|
return str(get_engine().url).replace('%', '%%')
|
|
|
|
|
|
# add your model's MetaData object here
|
|
# for 'autogenerate' support
|
|
# from myapp import mymodel
|
|
# target_metadata = mymodel.Base.metadata
|
|
config.set_main_option('sqlalchemy.url', get_engine_url())
|
|
target_db = current_app.extensions['migrate'].db
|
|
|
|
# other values from the config, defined by the needs of env.py,
|
|
# can be acquired:
|
|
# my_important_option = config.get_main_option("my_important_option")
|
|
# ... etc.
|
|
|
|
|
|
def get_metadata():
|
|
if hasattr(target_db, 'metadatas'):
|
|
return target_db.metadatas[None]
|
|
return target_db.metadata
|
|
|
|
|
|
def run_migrations_offline():
|
|
"""Run migrations in 'offline' mode.
|
|
|
|
This configures the context with just a URL
|
|
and not an Engine, though an Engine is acceptable
|
|
here as well. By skipping the Engine creation
|
|
we don't even need a DBAPI to be available.
|
|
|
|
Calls to context.execute() here emit the given string to the
|
|
script output.
|
|
|
|
"""
|
|
url = config.get_main_option("sqlalchemy.url")
|
|
context.configure(
|
|
url=url, target_metadata=get_metadata(), literal_binds=True
|
|
)
|
|
|
|
with context.begin_transaction():
|
|
context.run_migrations()
|
|
|
|
|
|
def run_migrations_online():
|
|
"""Run migrations in 'online' mode.
|
|
|
|
In this scenario we need to create an Engine
|
|
and associate a connection with the context.
|
|
|
|
"""
|
|
|
|
# this callback is used to prevent an auto-migration from being generated
|
|
# when there are no changes to the schema
|
|
# reference: http://alembic.zzzcomputing.com/en/latest/cookbook.html
|
|
def process_revision_directives(context, revision, directives):
|
|
if getattr(config.cmd_opts, 'autogenerate', False):
|
|
script = directives[0]
|
|
if script.upgrade_ops.is_empty():
|
|
directives[:] = []
|
|
logger.info('No changes in schema detected.')
|
|
|
|
conf_args = current_app.extensions['migrate'].configure_args
|
|
if conf_args.get("process_revision_directives") is None:
|
|
conf_args["process_revision_directives"] = process_revision_directives
|
|
|
|
connectable = get_engine()
|
|
|
|
# Alembic creates alembic_version.version_num as VARCHAR(32), but some
|
|
# revision ids in this chain exceed 32 chars. On MySQL that truncates the
|
|
# stored id, so the next migration's version bump matches 0 rows and the
|
|
# upgrade dies. Force the column wide in its OWN committed connection first
|
|
# (keeping it out of alembic's migration transaction), so long ids never
|
|
# truncate - fresh or existing.
|
|
try:
|
|
with connectable.connect() as prep:
|
|
prep.exec_driver_sql(
|
|
'CREATE TABLE IF NOT EXISTS alembic_version '
|
|
'(version_num VARCHAR(128) NOT NULL, '
|
|
'CONSTRAINT alembic_version_pkc PRIMARY KEY (version_num))'
|
|
)
|
|
prep.exec_driver_sql(
|
|
'ALTER TABLE alembic_version MODIFY version_num VARCHAR(128) NOT NULL'
|
|
)
|
|
prep.commit()
|
|
except Exception:
|
|
# Non-MySQL backends (e.g. sqlite in tests) - alembic's default is fine.
|
|
pass
|
|
|
|
with connectable.connect() as connection:
|
|
# Relax the session sql_mode for the migration run. Some historical
|
|
# migrations seed reference rows with raw INSERTs that omit NOT-NULL
|
|
# timestamp columns (the ORM supplies those via Python defaults at
|
|
# runtime, but a raw migration INSERT does not). MySQL 5.x's lax default
|
|
# accepted that; strict MySQL 8 rejects it with 1364 "Field 'createddate'
|
|
# doesn't have a default value". Dropping STRICT_TRANS_TABLES for the
|
|
# migration session only (the app's own connections keep their mode)
|
|
# makes the chain portable across MySQL versions.
|
|
try:
|
|
connection.exec_driver_sql(
|
|
"SET SESSION sql_mode = 'NO_ENGINE_SUBSTITUTION'")
|
|
except Exception:
|
|
pass # non-MySQL backends (e.g. sqlite in tests)
|
|
|
|
context.configure(
|
|
connection=connection,
|
|
target_metadata=get_metadata(),
|
|
**conf_args
|
|
)
|
|
|
|
with context.begin_transaction():
|
|
context.run_migrations()
|
|
|
|
|
|
if context.is_offline_mode():
|
|
run_migrations_offline()
|
|
else:
|
|
run_migrations_online()
|