We now have two web servers in the product: tlwebadm and tlwebaccess. Unfortunately the code is very poorly structured. tlwebaccess is more or less a complete copy of tlwebadm, which means we have to remember to fix everything in two places. The support library for tlwebadm modules also got moved into tlmisc. But half of the stuff in there is specific to tlwebadm and its module design rather than a generic web thing. We need better separation of general and specific things.
A restructure will probably warrant a new security audit in line with bug 4853.
Bug 4999 might be relevant when doing this as well.
*** Bug 5036 has been marked as a duplicate of this bug. ***
A lot of work towards this goal was done on bug 7187 and 7289 where they got some base classes for the most fundamental stuff.
Should be all done now. Tester needs to do a general check of tlwebaccess and tlwebadm. The following areas have been changed: Web Access: * Login form in web access * Session handling * VNC page (including error handling for people loading page directly) * New URLs, and redirection for old URLs tlwebadm: * JavaScript loading (used by profile configuration) * Translation handling (used by profile configuration) * List handling (used by shadowing configuration) Both: * Query handling (both POST and GET should work) * Static file serving (e.g. CSS) * Escaping of data in templates
(In reply to Pierre Ossman from comment #25) > Web Access: > > * Login form in web access > * Session handling > * VNC page (including error handling for people loading page directly) > * New URLs, and redirection for old URLs > > tlwebadm: > > * JavaScript loading (used by profile configuration) > * Translation handling (used by profile configuration) > * List handling (used by shadowing configuration) > > Both: > * Query handling (both POST and GET should work) > * Static file serving (e.g. CSS) Looked into these and they work fine. (Tested on Firefox 81) This howeverdoes not work in all cases (tested in tlwebadm): > * Escaping of data in templates Tested on 4.12 and this is not a regression introduced here. So I opened a new bug for this: Bug 7567