33 bundles

[cedricbonhomme]

The goal is to provide a way to create named collections/sets of vulnerabilities. With the possibility to add a little comment.

Notable changes

Bundles #33

• new SQLAlchemy model, Bundle, for the website (the migration script is included and the app update script now automatically execute any available migrations. See here);
• new API endpoint in order to manage bundles;
  • only administrators can create, edit and delete bundles.
  • bundles are always public
• a third tab, dedicated to the bundles, is now available in the vulnerability_view page (/vuln/vuln-id): this tab lists the bundles that reference the current vulnerability
• new view /bundle/<bundle-uuid> which is presenting the details about the bundle with a share button (Reddit, Newspipe, Pinboard)

User profile page

• whole new column based layout with data entirely loaded via the API.
• recent comments and bundles owned by a user are now displayed in 2 columns with dedicated RSS/ATOM feeds
• new RSS/ATOM feeds to publish the activity of the user (/user/<login>.atom or /user/<login>.rss) are available

Minor fixes

• fix: [website]: name of vendors returned by get_vendors are lowercase. This fixes an issue in the search by vendor
• fix: [website] vulnerabilitylookup.get_vendors returns lowercase results.
• various minor fixes

Minor changes

• chg: [security] Enable CSRF globally.
• chg: [website] Added a simple datalist refresh system in JavaScript for the freetext input field of the home page.
• chg: [website] Markdown code from GitHub, PySec and VarIoT advisories is now rendered.
• chg: [website] Backend does not validate JSON vuln data sent from an admin.
• chg: [website] A blocklist of usernames is now used to block words we might not like to see used as usernames.
• chg: [website] Replaced moment.js by Luxon.
• chg: [website] Added the possibility to specify a vendor id to the feed of recent vulnerabilities Subscribe to CPEs #50
• chg: [website] On the '/vuln/' page the number of elements in each tabs is now displayed in the tab name. This is a conveniency for the user.
• chg: [website] Improved about page.
• improvements to the display of the /recent pages. The table is easier to read with better sizing of the columns
• improvements to the different RSS/ATOM feeds (harmonization of the format and data)
• improvements to the users directory page
• various improvements to the API (harmonization of the query parameters, result marshaling and pagination)
• various small changes