CVS commit: pkgsrc/www/py-flask-security-too

["Mark Davies" <markd%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   markd
Date:           Mon Feb 12 05:25:03 UTC 2024

Modified Files:
        pkgsrc/www/py-flask-security-too: Makefile PLIST distinfo

Log Message:
py-flask-security-too: update to 5.3.3

Version 5.3.3
-------------

Fixes
+++++
- Once again work on open-redirect vulnerability - this time due to newer
  Werkzeug.

Version 5.3.2
-------------

Fixes
++++++
- Update Quickstart to show how to properly handle SQLAlchemy connections.
- Auth Token not returned from /tf-validate. (thanks lilz-egoto)
- Fix for latest email_validator deprecation - bump minimum to 2.0.0
- Deprecate passing in the anonymous_user class (sent to Flask-Login).

Version 5.3.1
-------------

**Please Note:**
- If your application uses webauthn you must use pydantic < 2.0
  until the issue with user_handle is resolved.
- If you want to use the latest Flask (3.0.0) you need to have Flask-Login
  changes - those aren't currently released - use the 'main' branch.

Fixes
++++++
- Compatability with Flask 3.0 (wangsha)
- Revert change in 5.3.0 that added a Referrer-Policy header.
- Fix error in quickstart (codycollier)
- Update Armenian translations (amkrtchyan-tmp)
- Update German translations. (sr-verde)
- Fix 'next' propagation when passed as form.next (thanks cariaso)

Version 5.3.0
-------------
This is a minor version bump due to some small backwards incompatible
changes to WebAuthn, recoverability (/reset), confirmation (/confirm)
and the two factor validity feature.

Fixes
++++++
- Webauthn Updates to handling of transport.
- Fix MongoDB support by eliminating dependency on flask-mongoengine.
  Improve MongoDB quickstart.
- Fix Quickstart for SQLAlchemy with scoped session.
- Login no longer, by default, checks for email deliverability.
- Token authentication is no longer accepted on endpoints which only allow
  'session' as authentication-method. (N247S)
- /reset and /confirm and GENERIC_RESPONSES and additional form args don't mix.
- Reset password can be exploited and other OWASP improvements.
- Confirmation can be exploited and other OWASP improvements.
- Convert to pyproject.toml, build, remove setup.py/.cfg.
- the tf_validity feature now ONLY sets a cookie - and the token is no longer
  returned as part of a JSON response.
- Fix login/unified signin templates to properly send CSRF token. Add more tests.
- Improve Social Oauth example code.

Backwards Compatibility Concerns
+++++++++++++++++++++++++++++++++

- To align with the W3C WebAuthn Level2 and 3 spec - transports are now
  part of the registration response.  This has been changed BOTH in the
  server code (using webauthn data structures) as well as the sample
  javascript code. If an application has their own javascript front end
  code - it might need to be changed.
- The tf_validity feature :py:data:`SECURITY_TWO_FACTOR_ALWAYS_VALIDATE`
  used to set a cookie if the request was form based, and return the token
  as part of a JSON response. Now, this feature is ONLY cookie based and
  the token is no longer returned as part of any response.
- Reset password was changed to adhere to OWASP recommendations and reduce
  possible exploitation:
  - A new email (with new token) is no longer sent upon expired token. Users
    must restart the reset password process.
  - The user is no longer automatically logged in upon successful password
    reset. For backwards compatibility :py:data:`SECURITY_AUTO_LOGIN_AFTER_RESET`
    can be set to ``True``.  Note that this compatibility feature is deprecated
    and will be removed in a future release.
  - Identity information (identity, email) is no longer sent as part of the
    URL redirect query params.
  - The SECURITY_MSG_PASSWORD_RESET_EXPIRED message no longer contains the
    user's identity/email.
  - The default for :py:data:`SECURITY_RESET_PASSWORD_WITHIN` has been changed
    from `5 days` to `1 days`.
  - The response to GET /reset/<token> sets the HTTP header `Referrer-Policy`
    to `no-referrer` as suggested by OWASP.
    *PLEASE NOTE: this was backed out in 5.3.1*
- Confirm email was changed to adhere to OWASP recommendations and reduce
  possible exploitation:
  - A new email (with new token) is no longer sent upon expired token. Users
    must restart the confirmation process.
  - Identity information (identity, email) is no longer sent as part of the
    URL redirect query params.
  - The :py:data:`SECURITY_AUTO_LOGIN_AFTER_CONFIRM` configuration variable
    now defaults to ``False`` - meaning after a successful email confirmation,
    the user must still sign in using the usual mechanisms. This is to align
    better with OWASP best practices. Setting it to ``True`` will restore
    prior behavior.
  - The SECURITY_MSG_CONFIRMATION_EXPIRED message no longer contains the
    user's identity/email.
  - The response to GET /reset/<token> sets the HTTP header `Referrer-Policy`
    to `no-referrer` as suggested by OWASP.
    *PLEASE NOTE: this was backed out in 5.3.1*


To generate a diff of this commit:
cvs rdiff -u -r1.3 -r1.4 pkgsrc/www/py-flask-security-too/Makefile
cvs rdiff -u -r1.1 -r1.2 pkgsrc/www/py-flask-security-too/PLIST \
    pkgsrc/www/py-flask-security-too/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/py-flask-security-too/Makefile
diff -u pkgsrc/www/py-flask-security-too/Makefile:1.3 pkgsrc/www/py-flask-security-too/Makefile:1.4
--- pkgsrc/www/py-flask-security-too/Makefile:1.3       Tue Aug  1 23:20:55 2023
+++ pkgsrc/www/py-flask-security-too/Makefile   Mon Feb 12 05:25:03 2024
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.3 2023/08/01 23:20:55 wiz Exp $
+# $NetBSD: Makefile,v 1.4 2024/02/12 05:25:03 markd Exp $
 
-DISTNAME=      Flask-Security-Too-5.2.0
+DISTNAME=      Flask-Security-Too-5.3.3
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME:tl}
 CATEGORIES=    www python
 MASTER_SITES=  ${MASTER_SITE_PYPI:=F/Flask-Security-Too/}
@@ -11,10 +11,13 @@ COMMENT=    Simple security for Flask apps
 LICENSE=       mit
 
 TOOL_DEPENDS+= ${PYPKGPREFIX}-babel>=2.12.1:../../devel/py-babel
-DEPENDS+=      ${PYPKGPREFIX}-email_validator>=1.1.1:../../mail/py-email_validator
-DEPENDS+=      ${PYPKGPREFIX}-flask>=2.3.0:../../www/py-flask
+TOOL_DEPENDS+= ${PYPKGPREFIX}-setuptools-[0-9]*:../../devel/py-setuptools
+TOOL_DEPENDS+= ${PYPKGPREFIX}-wheel-[0-9]*:../../devel/py-wheel
+DEPENDS+=      ${PYPKGPREFIX}-email_validator>=2.0.0:../../mail/py-email_validator
+DEPENDS+=      ${PYPKGPREFIX}-flask>=2.3.2:../../www/py-flask
+DEPENDS+=      ${PYPKGPREFIX}-flask-login>=0.6.2:../../www/py-flask-login
 DEPENDS+=      ${PYPKGPREFIX}-flask-principal>=0.4.0:../../www/py-flask-principal
-DEPENDS+=      ${PYPKGPREFIX}-flask-wtf>=1.1.1:../../www/py-flask-wtf
+DEPENDS+=      ${PYPKGPREFIX}-flask-wtf>=1.1.2:../../www/py-flask-wtf
 DEPENDS+=      ${PYPKGPREFIX}-importlib-resources>=5.10.0:../../devel/py-importlib-resources
 DEPENDS+=      ${PYPKGPREFIX}-passlib>=1.7.4:../../security/py-passlib
 DEPENDS+=      ${PYPKGPREFIX}-wtforms>=3.0.0:../../www/py-wtforms
@@ -23,5 +26,5 @@ USE_LANGUAGES=        # empty
 
 PYTHON_VERSIONS_INCOMPATIBLE=  27
 
-.include "../../lang/python/egg.mk"
+.include "../../lang/python/wheel.mk"
 .include "../../mk/bsd.pkg.mk"

Index: pkgsrc/www/py-flask-security-too/PLIST
diff -u pkgsrc/www/py-flask-security-too/PLIST:1.1 pkgsrc/www/py-flask-security-too/PLIST:1.2
--- pkgsrc/www/py-flask-security-too/PLIST:1.1  Sun Jun  4 00:02:53 2023
+++ pkgsrc/www/py-flask-security-too/PLIST      Mon Feb 12 05:25:03 2024
@@ -1,10 +1,10 @@
-@comment $NetBSD: PLIST,v 1.1 2023/06/04 00:02:53 markd Exp $
-${PYSITELIB}/${EGG_INFODIR}/PKG-INFO
-${PYSITELIB}/${EGG_INFODIR}/SOURCES.txt
-${PYSITELIB}/${EGG_INFODIR}/dependency_links.txt
-${PYSITELIB}/${EGG_INFODIR}/not-zip-safe
-${PYSITELIB}/${EGG_INFODIR}/requires.txt
-${PYSITELIB}/${EGG_INFODIR}/top_level.txt
+@comment $NetBSD: PLIST,v 1.2 2024/02/12 05:25:03 markd Exp $
+${PYSITELIB}/${WHEEL_INFODIR}/AUTHORS
+${PYSITELIB}/${WHEEL_INFODIR}/LICENSE
+${PYSITELIB}/${WHEEL_INFODIR}/METADATA
+${PYSITELIB}/${WHEEL_INFODIR}/RECORD
+${PYSITELIB}/${WHEEL_INFODIR}/WHEEL
+${PYSITELIB}/${WHEEL_INFODIR}/top_level.txt
 ${PYSITELIB}/flask_security/__init__.py
 ${PYSITELIB}/flask_security/__init__.pyc
 ${PYSITELIB}/flask_security/__init__.pyo
Index: pkgsrc/www/py-flask-security-too/distinfo
diff -u pkgsrc/www/py-flask-security-too/distinfo:1.1 pkgsrc/www/py-flask-security-too/distinfo:1.2
--- pkgsrc/www/py-flask-security-too/distinfo:1.1       Sun Jun  4 00:02:53 2023
+++ pkgsrc/www/py-flask-security-too/distinfo   Mon Feb 12 05:25:03 2024
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.1 2023/06/04 00:02:53 markd Exp $
+$NetBSD: distinfo,v 1.2 2024/02/12 05:25:03 markd Exp $
 
-BLAKE2s (Flask-Security-Too-5.2.0.tar.gz) = 4f4a994ced28b9f9ee60a0f7bba697066038c489f002288dbb8ab8498a8922ed
-SHA512 (Flask-Security-Too-5.2.0.tar.gz) = 9fb0d74092bd3caa38128bc38efaddbe849ce899ce27c9a327b8e4b5ee3889514c728658407a68258de36db927990c08a716d99ad9c713149db56c188ca61680
-Size (Flask-Security-Too-5.2.0.tar.gz) = 592946 bytes
+BLAKE2s (Flask-Security-Too-5.3.3.tar.gz) = 456e0735a1319a2db8b3383b73396ca513c91212c45caa3ffe48203925a46dd9
+SHA512 (Flask-Security-Too-5.3.3.tar.gz) = 9c60658fe3343b589aad13de75271a0154467de8da29d73ed6e685c57c47685decbb5691e3ee7a812d871b687de67085ae743a775da3387252a53d6a5d62d6ac
+Size (Flask-Security-Too-5.3.3.tar.gz) = 616595 bytes