Repository navigation
Fix v0.9.26 hiroba w2026 64 hiroba - #1946
Merged
kanon-yoneji merged 16 commits intoOct 23, 2026
Merged
kanon-yoneji merged 16 commits into
kanon-yoneji merged 16 commits into
Conversation
W2025-33_early(release: 2026/03/30) from V0.9.26 hiroba develop
V0.9.26 hiroba develop
Update get_search_data API access control and tests(#63219)
…rom_W2026-64_hiroba fix charge process to use server-calculated price and handle price changes(#63646)
…vert_php_to_py Convert PHP files to Python and update related configuration(#63830)
Reviewer's GuideThis PR consolidates Jinja/Babel extraction settings, migrates the Shibboleth login proxy from PHP-FPM to a Python CGI served through fcgiwrap, adds permission enforcement for search-data APIs, and hardens file charging by recalculating prices server-side with client handling for price changes. Sequence diagram for server-validated file chargingsequenceDiagram
actor User
participant Browser
participant Charge as charge()
participant Permission as get_file_charge_info()
participant Payment as create_charge()
User->>Browser: Click charge confirmation
Browser->>Charge: GET /charge with item_id, file_name, price
Charge->>Permission: get_file_charge_info(item_id, file_name)
Permission-->>Charge: server_price, unit, status
alt price differs
Charge-->>Browser: price_changed with new price and unit
Browser->>Browser: showChargeConfirmation()
else price matches
Charge->>Payment: create_charge(user_id, item_id, server_price, title, file_url, ret_url)
Payment-->>Charge: redirect URL or payment result
Charge-->>Browser: charge status
end
Flow diagram for price-change charge recoveryflowchart TD
Start[Charge confirmation accepted] --> Request[Browser calls /charge]
Request --> Validate["get_file_charge_info()"]
Validate --> Match{Requested price matches server price?}
Match -->|Yes| Create["create_charge()"]
Create --> Result[Show payment result]
Match -->|No| Remove["removeChargeItem()"]
Remove --> Update[Update button price and unit]
Update --> Confirm["showChargeConfirmation()"]
Confirm --> Request
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
kanon-yoneji
merged commit Oct 23, 2026
d089676
into
RCOSDP:v0.9.26_hiroba_develop
1 of 84 checks passed
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 3 security issues
Security issues:
- User controlled data in methods like
innerHTML,outerHTMLordocument.writeis an anti-pattern that can lead to XSS vulnerabilities (link) - User controlled data in a
textarea.innerHTMLis an anti-pattern that can lead to XSS vulnerabilities (link) - Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation. (link)
Fixed security issues:
- SSL verification is disabled but should not be (currently CURLOPT_SSL_VERIFYPEER= false) (link)
- The 'phpinfo' function may reveal sensitive information about your environment. (link)
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="modules/weko-records-ui/weko_records_ui/static/js/weko_records_ui/app.js" line_range="390" />
<code_context>
textarea.innerHTML = String(value);
</code_context>
<issue_to_address>
**security (javascript.browser.security.insecure-document-method):** User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities
*Source: opengrep*
</issue_to_address>
### Comment 2
<location path="modules/weko-records-ui/weko_records_ui/static/js/weko_records_ui/app.js" line_range="390" />
<code_context>
textarea.innerHTML = String(value);
</code_context>
<issue_to_address>
**security (javascript.browser.security.insecure-innerhtml):** User controlled data in a `textarea.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities
*Source: opengrep*
</issue_to_address>
### Comment 3
<location path="nginx/login.py" line_range="50" />
<code_context>
response = requests.post(url, data=data, verify=False, cookies=cookie_jar)
</code_context>
<issue_to_address>
**security (python.requests.security.disabled-cert-validation):** Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation.
*Source: opengrep*
</issue_to_address>Sourcery assessment
Needs a human reviewer. 3 findings to address first, and the charge endpoint now uses the server-resolved price to create an external payment, so a defect in resolving the file’s billing metadata or price can result in an incorrect charge. Reverting would stop future charges but would not undo payments already processed.
Blocking findings: modules/weko-records-ui/weko_records_ui/static/js/weko_records_ui/app.js:390, modules/weko-records-ui/weko_records_ui/static/js/weko_records_ui/app.js:390, nginx/login.py:50
| function showChargeConfirmation(price, unit, priceChanged, previousPrice, previousUnit) { | ||
| const getDisplayUnit = function (value) { | ||
| const textarea = document.createElement('textarea'); | ||
| textarea.innerHTML = String(value); |
There was a problem hiding this comment.
security (javascript.browser.security.insecure-document-method): User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities
Source: opengrep
| function showChargeConfirmation(price, unit, priceChanged, previousPrice, previousUnit) { | ||
| const getDisplayUnit = function (value) { | ||
| const textarea = document.createElement('textarea'); | ||
| textarea.innerHTML = String(value); |
There was a problem hiding this comment.
security (javascript.browser.security.insecure-innerhtml): User controlled data in a textarea.innerHTML is an anti-pattern that can lead to XSS vulnerabilities
Source: opengrep
| cookie_jar = cookiejar.LWPCookieJar(temp_path) | ||
|
|
||
| # Request to the Shibboleth login | ||
| response = requests.post(url, data=data, verify=False, cookies=cookie_jar) |
There was a problem hiding this comment.
security (python.requests.security.disabled-cert-validation): Certificate verification has been explicitly disabled. This permits insecure connections to insecure servers. Re-enable certification validation.
Source: opengrep
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
概要 (Summary)
Summary by Sourcery
Harden authentication, search-data access, and billing workflows while migrating the Shibboleth login proxy from PHP to Python.
New Features:
Bug Fixes:
Enhancements:
Build:
Deployment:
Tests: